logo

Database

Lack of data validation In org.apache.poi:poi

Description

Improper Input Validation in Apache POI Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2014-35742. NVD-2014-35743. OSV-2014-35744. OSV-DEBIAN-2014-35745. GCVE-2014-35746. BUGZILLA-CVE-2014-35747. SECURITY-TRACKER-CVE-2014-3574

References

1. https://exchange.xforce.ibmcloud.com/vulnerabilities/957682. https://lucene.apache.org/solr/solrnews.html#18-august-2014-recommendation-to-update-apache-poi-in-apache-solr-480-481-and-490-installations3. https://svn.apache.org/repos/asf/poi/branches/REL_3_10_BRANCH@16165094. https://svn.apache.org/repos/asf/poi/trunk@16157205. https://svn.apache.org/repos/asf/poi/trunk@16157316. https://svn.apache.org/repos/asf/poi/trunk@16157817. http://poi.apache.org/changes.html8. http://rhn.redhat.com/errata/RHSA-2014-1370.html9. http://rhn.redhat.com/errata/RHSA-2014-1398.html10. http://rhn.redhat.com/errata/RHSA-2014-1399.html11. http://rhn.redhat.com/errata/RHSA-2014-1400.html12. http://www-01.ibm.com/support/docview.wss?uid=swg2199675913. http://www.apache.org/dist/poi/release/RELEASE-NOTES.txt14. https://issues.apache.org/bugzilla/show_bug.cgi?id=54764

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.