Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2020-9489

Опубликовано: 27 апр. 2020
Источник: nvd
CVSS3: 5.5
CVSS2: 4.3
EPSS Низкий

Описание

A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.

Ссылки

Уязвимые конфигурации

Конфигурация 1
cpe:2.3:a:apache:tika:1.24:*:*:*:*:*:*:*
Конфигурация 2

Одно из

cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*
Версия от 17.7 (включая) до 17.12 (включая)
cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*
cpe:2.3:a:oracle:primavera_unifier:19.12:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_portal:12.2.1.3.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:webcenter_portal:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:o:oracle:communications_messaging_server:8.1:*:*:*:*:*:*:*

EPSS

Процентиль: 60%
0.0039
Низкий

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-835

Связанные уязвимости

ubuntu логотип

CVE-2020-9489

CVSS3: 5.5
ubuntu
почти 6 лет назад

A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.

redhat логотип

CVE-2020-9489

CVSS3: 5.5
redhat
почти 6 лет назад

A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.

debian логотип

CVE-2020-9489

CVSS3: 5.5
debian
почти 6 лет назад

A carefully crafted or corrupt file may trigger a System.exit in Tika' ...

github логотип

GHSA-4pv3-63jw-4jw2

CVSS3: 5.5
github
больше 4 лет назад

Missing Release of Memory after Effective Lifetime in Apache Tika

fstec логотип

BDU:2020-05177

CVSS3: 6.5
fstec
почти 6 лет назад

Уязвимость среды обнаружения и анализа контента Apache Tika, связанная с ошибками освобождения памяти перед удалением последней ссылки, позволяющая нарушителю вызвать отказ в обслуживании

EPSS

Процентиль: 60%
0.0039
Низкий

5.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-835