diff --git a/sc/prj/build.lst b/sc/prj/build.lst
index 1a641a67f461..95d5827c3e33 100755
--- a/sc/prj/build.lst
+++ b/sc/prj/build.lst
@@ -1,4 +1,4 @@
-sc      sc      :       filter l10n vbahelper oovbaapi svx uui stoc BOOST:boost formula MDDS:mdds oox NULL
+sc      sc      :       filter l10n vbahelper oovbaapi svx uui stoc BOOST:boost formula MDDS:mdds oox unoxml NULL
 sc	sc							usr1	-	all	sc_mkout NULL
 sc	sc\inc							nmake	-	all	sc_inc NULL
 sc	sc\prj							get	-	all	sc_prj NULL
diff --git a/sc/qa/unit/CVE/CVE-2007-5745-1.wb2 b/sc/qa/unit/CVE/CVE-2007-5745-1.wb2
new file mode 100644
index 000000000000..0ba60b26cda7
Binary files /dev/null and b/sc/qa/unit/CVE/CVE-2007-5745-1.wb2 differ
diff --git a/sc/qa/unit/CVE/CVE-2007-5745-2.wb2 b/sc/qa/unit/CVE/CVE-2007-5745-2.wb2
new file mode 100644
index 000000000000..8a9eca970532
Binary files /dev/null and b/sc/qa/unit/CVE/CVE-2007-5745-2.wb2 differ
diff --git a/sc/qa/unit/CVE/CVE-2007-5747-1.wb2 b/sc/qa/unit/CVE/CVE-2007-5747-1.wb2
new file mode 100644
index 000000000000..ca91826b9be9
Binary files /dev/null and b/sc/qa/unit/CVE/CVE-2007-5747-1.wb2 differ
diff --git a/sc/qa/unit/makefile.mk b/sc/qa/unit/makefile.mk
index a36e909d7664..335a8b7bc70b 100644
--- a/sc/qa/unit/makefile.mk
+++ b/sc/qa/unit/makefile.mk
@@ -95,6 +95,11 @@ $(MISC)/$(TARGET)/services.rdb .ERRREMOVE : $(MISC)/$(TARGET)/udkapi.rdb makefil
     $(MKDIRHIER) $(@:d)
     $(REGCOMP) -register -br $(MISC)/$(TARGET)/udkapi.rdb -r $@ -wop \
         -c $(DLLPRE)fwk$(DLLPOSTFIX)$(DLLPOST) \
+        -c $(DLLPRE)sfx$(DLLPOSTFIX)$(DLLPOST) \
+        -c $(DLLPRE)ucb1$(DLLPOST) \
+        -c $(DLLPRE)ucpfile1$(DLLPOST) \
+        -c $(DLLPRE)unoxml$(DLLPOSTFIX)$(DLLPOST) \
+        -c stocservices.uno$(DLLPOST) \
         -c i18npool.uno$(DLLPOST)
 
 #Tweak things so that we use the .res files in the solver
diff --git a/sc/qa/unit/ucalc.cxx b/sc/qa/unit/ucalc.cxx
index 725ea734af81..b5b52709d206 100644
--- a/sc/qa/unit/ucalc.cxx
+++ b/sc/qa/unit/ucalc.cxx
@@ -53,9 +53,12 @@
 #include <cppunit/plugin/TestPlugIn.h>
 
 #include <sal/config.h>
+#include <osl/file.hxx>
+#include <osl/process.h>
 
 #include <cppuhelper/bootstrap.hxx>
 #include <comphelper/processfactory.hxx>
+#include <comphelper/oslfile2streamwrap.hxx>
 
 #include <vcl/svapp.hxx>
 #include "scdll.hxx"
@@ -76,9 +79,14 @@
 #include <svx/svdograf.hxx>
 #include <svx/svdpage.hxx>
 
+#include <sfx2/docfilt.hxx>
+#include <sfx2/docfile.hxx>
+
 #include <com/sun/star/sheet/DataPilotFieldOrientation.hpp>
 #include <com/sun/star/sheet/GeneralFunction.hpp>
 
+#include <ucbhelper/contentbroker.hxx>
+
 #include <iostream>
 #include <vector>
 
@@ -216,6 +224,8 @@ public:
     virtual void setUp();
     virtual void tearDown();
 
+    bool testLoad(const rtl::OUString &rFilter, const rtl::OUString &rURL);
+
     void testCollator();
     void testSUM();
     void testNamedRange();
@@ -232,6 +242,11 @@ public:
 
     void testGraphicsInGroup();
 
+    /**
+     * Ensure CVEs remain unbroken
+     */
+    void testCVEs();
+
     CPPUNIT_TEST_SUITE(Test);
     CPPUNIT_TEST(testCollator);
     CPPUNIT_TEST(testSUM);
@@ -242,12 +257,14 @@ public:
     CPPUNIT_TEST(testSheetCopy);
     CPPUNIT_TEST(testGraphicsInGroup);
     CPPUNIT_TEST(testFunctionLists);
+    CPPUNIT_TEST(testCVEs);
     CPPUNIT_TEST_SUITE_END();
 
 private:
     uno::Reference< uno::XComponentContext > m_xContext;
     ScDocument *m_pDoc;
-    ScDocShellRef m_pDocShell;
+    ScDocShellRef m_xDocShRef;
+    ::rtl::OUString m_aPWDURL;
 };
 
 Test::Test()
@@ -263,20 +280,40 @@ Test::Test()
     //of retaining references to the root ServiceFactory as its passed around
     comphelper::setProcessServiceFactory(xSM);
 
+    // initialise UCB-Broker
+    uno::Sequence<uno::Any> aUcbInitSequence(2);
+    aUcbInitSequence[0] <<= rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("Local"));
+    aUcbInitSequence[1] <<= rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("Office"));
+    bool bInitUcb = ucbhelper::ContentBroker::initialize(xSM, aUcbInitSequence);
+    CPPUNIT_ASSERT_MESSAGE("Should be able to initialize UCB", bInitUcb);
+
+    uno::Reference<ucb::XContentProviderManager> xUcb =
+        ucbhelper::ContentBroker::get()->getContentProviderManagerInterface();
+    uno::Reference<ucb::XContentProvider> xFileProvider(xSM->createInstance(
+        rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("com.sun.star.ucb.FileContentProvider"))), uno::UNO_QUERY);
+    xUcb->registerContentProvider(xFileProvider, rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("file")), sal_True);
+
     InitVCL(xSM);
 
     ScDLL::Init();
+
+    oslProcessError err = osl_getProcessWorkingDir(&m_aPWDURL.pData);
+    CPPUNIT_ASSERT_MESSAGE("no PWD!", err == osl_Process_E_None);
 }
 
 void Test::setUp()
 {
-    m_pDocShell = new ScDocShell;
-    m_pDoc = m_pDocShell->GetDocument();
+    m_xDocShRef = new ScDocShell(
+        SFXMODEL_STANDARD |
+        SFXMODEL_DISABLE_EMBEDDED_SCRIPTS |
+        SFXMODEL_DISABLE_DOCUMENT_RECOVERY);
+
+    m_pDoc = m_xDocShRef->GetDocument();
 }
 
 void Test::tearDown()
 {
-    m_pDocShell.Clear();
+    m_xDocShRef.Clear();
 }
 
 Test::~Test()
@@ -371,6 +408,36 @@ void Test::testCSV()
     }
 }
 
+bool Test::testLoad(const rtl::OUString &rFilter, const rtl::OUString &rURL)
+{
+    SfxFilter aFilter(
+        rFilter,
+        rtl::OUString(), 0, 0, rtl::OUString(), 0, rtl::OUString(),
+        rtl::OUString(), rtl::OUString() );
+
+    ScDocShellRef xDocShRef = new ScDocShell;
+    SfxMedium aSrcMed(rURL, STREAM_STD_READ, true);
+    aSrcMed.SetFilter(&aFilter);
+    return xDocShRef->DoLoad(&aSrcMed);
+}
+
+void Test::testCVEs()
+{
+    bool bResult;
+
+    bResult = testLoad(rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("Quattro Pro 6.0")),
+        m_aPWDURL + rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("/CVE/CVE-2007-5745-1.wb2")));
+    CPPUNIT_ASSERT_MESSAGE("CVE-2007-5745 regression", bResult == true);
+
+    bResult = testLoad(rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("Quattro Pro 6.0")),
+        m_aPWDURL + rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("/CVE/CVE-2007-5745-2.wb2")));
+    CPPUNIT_ASSERT_MESSAGE("CVE-2007-5745 regression", bResult == true);
+
+    bResult = testLoad(rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("Quattro Pro 6.0")),
+        m_aPWDURL + rtl::OUString(RTL_CONSTASCII_USTRINGPARAM("/CVE/CVE-2007-5747-1.wb2")));
+    CPPUNIT_ASSERT_MESSAGE("CVE-2007-5747 regression", bResult == false);
+}
+
 template<typename Evaluator>
 void checkMatrixElements(const ScMatrix& rMat)
 {