Описание
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
It was found that Apache POI would expand an unlimited number of entities in OOXML documents. A remote attacker able to supply OOXML documents that are parsed by Apache POI could use this flaw to trigger a denial of service attack via excessive CPU and memory consumption.
Отчет
Red Hat Product Security has determined that CVE-2014-3574 is not exploitable by default in JBoss Portal Platform as provided by Red Hat. This flaw would only be exploitable if the Apache POI library provided by JBoss Portal Platform were used by a custom application to process user-supplied XML documents.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat BPM Suite 6 | apache-poi | Affected | ||
| Red Hat Enterprise Virtualization 3 | jasperreports-server-pro | Affected | ||
| Red Hat JBoss BRMS 5 | apache-poi | Will not fix | ||
| Red Hat JBoss BRMS 6 | apache-poi | Affected | ||
| Red Hat JBoss Portal 5 | apache-poi | Will not fix | ||
| Red Hat JBoss SOA Platform 4 | apache-poi | Will not fix | ||
| Red Hat Satellite 5 | apache-poi | Will not fix | ||
| Red Hat JBoss BPMS 6.0 | Fixed | RHSA-2014:1399 | 13.10.2014 | |
| Red Hat JBoss BRMS 6.0 | Fixed | RHSA-2014:1400 | 13.10.2014 | |
| Red Hat JBoss Data Virtualization 6.0 | apache-poi | Fixed | RHSA-2014:1398 | 13.10.2014 |
Показывать по
Дополнительная информация
Статус:
5 Medium
CVSS2
Связанные уязвимости
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote at ...
5 Medium
CVSS2