Security Bulletin: IBM Engineering Lifecycle Management - Doors Next is impacted by vulnerabilities

Summary A vulnerability has been identified in poi-ooxml library, which is used in IBM Engineering Lifecycle Management - Doors Next. Vulnerability Details CVEID:CVE-2025-31672 DESCRIPTION: Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files...

Security Bulletin: IBM InfoSphere Information Server is affected by an improper input validation vulnerability in Apache POI (CVE-2025-31672)

Summary An improper input validation vulnerability in Apache POI that is used by InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2025-31672 DESCRIPTION: Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xls...

Security Bulletin: Improper Input Validation in Apache POI OOXML Parsing Allows Ambiguity with Duplicate ZIP Entries (Fixed in poi-ooxml 5.4.0) affects watsonx.data

Summary Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In...

Security Bulletin: There is a vulnerability in poi-ooxml-5.3.0.jarused by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2025-31672)

Summary There is a vulnerability in poi-ooxml-5.3.0.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2025-31672 DESCRIPTION: Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like...

br.com.digix:editordedocumento (>=1.1.8, <=2.4.0), br.com.tecsinapse:tecsinapse-data-io (>=2.0.0, <=3.0.3-b) +219 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.14)

org.apache.poi:poi-ooxml MAVEN version 3.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - br.com.digix:editordedocumento =1.1.8, =2.0.0, =1.0.0, =0.0.3, =0.3.0, =v1.0.13oldrzm, =v1.0.13oldrzm,...

com.adobe.granite:com.adobe.granite.poi (1.0.2), com.day.crx:crx-server-j2ee (2.3.6) +46 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.8-beta4)

org.apache.poi:poi-ooxml MAVEN version 3.8-beta4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - com.adobe.granite:com.adobe.granite.poi 1.0.2 - com.day.crx:crx-server-j2ee 2.3.6 -...

com.qaprosoft:carina-dataprovider (>=5.2.1.30, <=6.4.36), org.apache.poi:poi-examples (3.11-beta3) +1 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.11-beta3)

org.apache.poi:poi-ooxml MAVEN version 3.11-beta3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - com.qaprosoft:carina-dataprovider =5.2.1.30, =6.4.36 - org.apache.poi:poi-examples 3.11-beta3 -...

com.deepoove:poi-tl (0.0.3), com.github.kulya:jmeter-gradle-plugin (1.3.4-2.12) +25 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.11-beta2)

org.apache.poi:poi-ooxml MAVEN version 3.11-beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - com.deepoove:poi-tl 0.0.3 - com.github.kulya:jmeter-gradle-plugin 1.3.4-2.12 -...

Improper Input Validation

Overview org.apache.poi:poi-ooxml is a Java API To Access Microsoft Format Files. Affected versions of this package are vulnerable to Improper Input Validation due to the parsing process of OOXML format files. An attacker can manipulate the file content by adding zip entries with duplicate names,...

org.apache.tika:tika (0.3) potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.5-beta5)

org.apache.poi:poi-ooxml MAVEN version 3.5-beta5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - org.apache.tika:tika 0.3 Source cves: CVE-2025-31672 Source advisory: OSV:GHSA-GMG8-593G-7MV3...

org.apache.jackrabbit:jackrabbit-core (>=2.0-beta1, <=2.0-beta3), org.apache.jackrabbit:jackrabbit-jca (>=2.0-beta1, <=2.0-beta3) +7 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.5-beta6)

org.apache.poi:poi-ooxml MAVEN version 3.5-beta6 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - org.apache.jackrabbit:jackrabbit-core =2.0-beta1, =2.0-beta1, =2.0-beta1, =1.4.0, =1.4.0.1, =1.4.1.0,...

org.apache.poi:poi-examples (3.8-beta2), org.apache.poi:poi-excelant (3.8-beta2) potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.8-beta2)

org.apache.poi:poi-ooxml MAVEN version 3.8-beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - org.apache.poi:poi-examples 3.8-beta2 - org.apache.poi:poi-excelant 3.8-beta2 Source cves: CVE-2025-31672...

org.apache.poi:poi-examples (3.7-beta1) potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.7-beta1)

org.apache.poi:poi-ooxml MAVEN version 3.7-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - org.apache.poi:poi-examples 3.7-beta1 Source cves: CVE-2025-31672 Source advisory: OSV:GHSA-GMG8-593G-7MV3...

be.thematchbox:abstractriver (>=1.0.1, <=1.1.0), com.findwise.hydra:hydra-tika-stages (0.4.5) +42 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.10-beta2)

org.apache.poi:poi-ooxml MAVEN version 3.10-beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - be.thematchbox:abstractriver =1.0.1, =4.0, =0.9.3, =1.7.0, =1.7.3 - org.apache.poi:poi-examples 3.10-beta2...

br.com.jarch:jarch-annotation (>=2.23.5, <=20.2.0), br.com.jarch:jarch-apt (>=2.23.5, <=25.11.0) +214 more potentially affected by CVE-2025-31672 via org.apache.poi:poi-ooxml (3.12)

org.apache.poi:poi-ooxml MAVEN version 3.12 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi-ooxml and may be impacted: - br.com.jarch:jarch-annotation =2.23.5, =2.23.5, =19.1.0, =2.23.5, =2.23.5, =20.3.0, =2.23.5, =2.23.5, =24.2.0,...

CVE-2025-31672

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

CVE-2025-31672: Improper Input Validation

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names including the path in the zip. In this cas...

Security Bulletin: Atlas eDiscovery Process Management is affected by a vulnerable poi-ooxml-3.9.jar

Summary Atlas eDiscovery Process Management is affected by a vulnerable poi-ooxml-3.9.jar. Hence poi-ooxml-3.9.jar upgraded to poi-ooxml-4.0.jar to fix vulnerabilities. Vulnerability Details CVEID:CVE-2017-5644 DESCRIPTION: Apache POI is vulnerable to a denial of service, cause by an XML External...

org.apache.poi:poi-contrib (3.7-beta1), org.apache.poi:poi-examples (3.7-beta1) +2 more potentially affected by CVE-2019-12415 via org.apache.poi:poi (3.7-beta1)

org.apache.poi:poi MAVEN version 3.7-beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi and may be impacted: - org.apache.poi:poi-contrib 3.7-beta1 - org.apache.poi:poi-examples 3.7-beta1 - org.apache.poi:poi-ooxml 3.7-beta1 -...

org.apache.poi:poi-contrib (3.7-beta2), org.apache.poi:poi-examples (3.7-beta2) +2 more potentially affected by CVE-2019-12415 via org.apache.poi:poi (3.7-beta2)

org.apache.poi:poi MAVEN version 3.7-beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.poi:poi and may be impacted: - org.apache.poi:poi-contrib 3.7-beta2 - org.apache.poi:poi-examples 3.7-beta2 - org.apache.poi:poi-ooxml 3.7-beta2 -...