| Package | Affected versions | Patched versions |
|---|---|---|
| org.apache.poi:poi | < 3.10-beta1 | 3.10-beta1 |
| org.apache.poi:poi-scratchpad | < 3.10-beta1 | 3.10-beta1 |
| poi | = 0.1= 0.10.0= 0.11.0= 0.12.0= 0.13.0= 0.14.0= 0.2= 0.3= 0.4= 0.5= 0.6= 0.7= 1.0.0= 1.0.1= 1.0.2= 1.1.0= 1.10= 1.2.0= 1.5= 1.5.1= 1.7= 1.8= 2.0= 2.5= 2.5.1= 3.0= 3.0.1= 3.0.2= 3.1= 3.2= 3.5= 3.6= 3.7= 3.8≤ 3.8 |
The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Channel Definition Format (CDF) or Compound File Binary Format (CFBF) document.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free