Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (August 2025 - Part 1 of 2)

Summary Multiple vulnerabilities have been addressed in Data Virtualization on IBM Software Hub. Note that Data Virtualization was named Watson Query on IBM Cloud Pak for Data version 4.8. Vulnerability Details CVEID:CVE-2025-31672 DESCRIPTION: Improper Input Validation vulnerability in Apache PO...

DEBIAN-CVE-2025-31672

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

UBUNTU-CVE-2025-31672

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

Astra Linux – Vulnerability in LibreOffice

A out-of-bounds write vulnerability exists in The Document Foundation LibreOffice due to crafted OOXML documents with mismatched encryption salt parameters. This issue affects LibreOffice versions starting from 26.2 before 26.2.3, and also versions starting from 25.8 before 25.8.7...

CVE-2023-51568

Kofax Power PDF OXPS File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Kofax Power PDF. User interaction is required to exploit this vulnerability in that the target must visi...

SUSE CVE-2013-4156

Apache OpenOffice.org OOo before 4.0 allows remote attackers to cause a denial of service memory corruption or possibly have unspecified other impact via a crafted element in an OOXML document file...

SUSE CVE-2021-26222

The ezxmlnew function in ezXML 0.8.6 and earlier is vulnerable to OOB write when opening XML file after exhausting the memory pool...

Countering Follina Attack (CVE- 2022-30190) with Trellix Network Security Platform’s Advanced Detection Features

Countering Follina Attack CVE- 2022-30190 with Trellix Network Security Platform’s Advanced Detection Features By Trellix · July 19, 2022 This blog was also written by Chintan Shah Executive summary During the end of May 2022, independent security researcher reported a vulnerability assigned...

GHSA-78VV-QJ73-H9M5 Improper Restriction of Recursive Entity References in DTDs in Apache POI

Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service CPU consumption via a specially crafted OOXML file, aka an XML Entity Expansion XEE attack...

OESA-2022-1508 clamav security update

End-user tools for the Clam Antivirus scanner. Security Fixes: A vulnerability in the OOXML parsing module in Clam AntiVirus ClamAV Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an...

Open-xchange OX App Suite 路径遍历漏洞

Open-xchange OX App Suite is a Web cloud desktop environment from Open-Xchange Open-xchange, a US-based company. The environment allows users to more intuitively manage email, tasks, files, etc. A directory traversal vulnerability exists in Open-xchange OX App Suite, which can be exploited by...

VulnCheck KEV: CVE-2010-3336

Microsoft Office XP SP3, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac allow remote attackers to execute arbitrary code via a crafted Office document that triggers memory corruption, aka "MSO Large SPID Read AV Vulnerability."...

VulnCheck KEV: CVE-2011-0097

Integer underflow in Microsoft Excel 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Excel Viewer SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP2 allows remote attackers to execute arbitrary...

PT-2020-5910 · Phoenix Contact · Pc Worx Express +1

Name of the Vulnerable Software and Affected Versions: Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier Description: The issue is related to the parsing of PLCopen XML files in Phoenix Contact PC Worx and PC Worx Express, which can lead to a stack-based overflow due to...

Description of the Open XML File Format Converter for Mac 1.0.2 Update

The Open XML File Format Converter for Mac 1.0.2 Update includes fixes for vulnerabilities that an attacker can use to overwrite the contents of a computer's memory by using malicious code.INTRODUCTION Microsoft has released security bulletins MS08-072 and MS08-074. These security bulletins conta...

PowerPoint ‘Weakness’ Opens Door to Malicious Mouse-Over Attack

A researcher is sounding the alarm over what he believes could be a novel attack vector which allows a hacker to manipulate a PowerPoint file to download and begin the installation of malware, simply by hovering over a hypertext link. The technique does require a victim to accept one pop-up...

GHSA-4XR4-4C65-HJ7F Apache Tika does not properly initialize the XML parser or choose handlers

Apache Tika before 1.13 does not properly initialize the XML parser or choose handlers, which might allow remote attackers to conduct XML External Entity XXE attacks via vectors involving 1 spreadsheets in OOXML files and 2 XMP metadata in PDF and other file formats, a related issue to...

The vulnerability of the Office Open XML Text Processor, the Atlantis Word Processor, allows a hacker to execute arbitrary code.

The vulnerability of the Office Open XML Text Processor, the Atlantis Word Processor, arises due to errors during initialization of pointers. Exploiting this vulnerability allows a malicious actor to execute arbitrary code within an application, using a specially created document...

Microsoft Office: Block opening of pre-release versions of file formats new to Excel 2013

This test checks the setting for policy OpenVAS Vulnerability Test $Id: officeexcelconverters.nasl 11843 2018-10-11 14:33:21Z emoss $ Check value for Block opening of pre-release versions of file formats new to Excel 2013 through the Compatibility Pack for Office 2013 and Excel 2013 Converter...

CVE-2018-4001

An exploitable uninitialized pointer vulnerability exists in the Office Open XML parser of Atlantis Word Processor, version 3.2.5.0. A specially crafted document can cause an uninitialized pointer representing a TTableRow to be assigned to a variable on the stack. This variable is later...