Описание
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| libapache-poi-java | fixed | 3.17-1 | package | |
| libapache-poi-java | no-dsa | stretch | package | |
| libapache-poi-java | no-dsa | jessie | package | |
| libapache-poi-java | no-dsa | wheezy | package |
Примечания
https://www.openwall.com/lists/oss-security/2017/03/20/9
Связанные уязвимости
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption) via a specially crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
Improper Restriction of Recursive Entity References in DTDs in Apache POI
ALT-PU-2017-3666: package `apache-poi` update to version 3.15-alt1_1jpp8