Veracode Vulnerability DatabaseVERACODE:5760Denial Of Service (DoS)
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P
Apache poi is vulnerable to denial of service (DoS) attacks. Attackers can cause infinite loops, when parsing WMF, EMF, MSG and macro files. They can also cause Out-of-Memory (OOM) exceptions to occur when parsing DOC, PPT and XLS files.
| CPE | Name | Operator | Version |
|---|---|---|---|
| apache poi - common | eq | 3.2-FINAL-20081019 | |
| apache poi - common | le | 3.17-beta1 | |
| apache poi | le | 3.17-beta1 | |
| apache poi | le | 3.14-beta1 |
References
mail-archives.us.apache.org/mod_mbox/www-announce/201801.mbox/%[email protected]%3E
www.securityfocus.com/bid/102879
access.redhat.com/errata/RHSA-2018:1322
bz.apache.org/bugzilla/show_bug.cgi?id=52372
bz.apache.org/bugzilla/show_bug.cgi?id=61294
bz.apache.org/bugzilla/show_bug.cgi?id=61295
bz.apache.org/bugzilla/show_bug.cgi?id=61338
github.com/apache/poi/commit/a07ed9e86474da98f204efadfd5b9327009a0d21
github.com/apache/poi/commit/cd6236c74b55763a27e3e9b5f269c28bc9c98419
github.com/apache/poi/commit/df3910135fd9c442b4e746e4b156362fd2e8d755
github.com/apache/poi/compare/d1a51f76f0786c1e1c515cab362550cebd525589...c7db66a30dfb6cbbd5812ff3ae4c90ed2d9b9a27
lists.apache.org/thread.html/453d9af5dbabaccd9afb58d27279a9dbfe8e35f4e5ea1645ddd6960b@%3Cdev.poi.apache.org%3E
lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E
www.oracle.com/security-alerts/cpuapr2020.html
www.oracle.com/security-alerts/cpuApr2021.html
www.oracle.com/security-alerts/cpujan2020.html
www.oracle.com/security-alerts/cpujan2021.html
www.oracle.com/security-alerts/cpujul2020.html
www.oracle.com/security-alerts/cpuoct2020.html
www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:N/I:N/A:P