GitHub Advisoryadvisory · Maven

GHSA-jqx5-h2hw-5q4f Denial of Service in Apache POI

MEDIUM Published 2022-05-04 Modified 2024-03-05 Official page ↗
Aliases
CVE-2012-0213
Ecosystem
Maven
Packages
org.apache.poi:poi, org.apache.poi:poi-scratchpad
Severity
Moderate
Weaknesses
CWE-400
Reviewed
2022-07-13

Affected packages

• Maven org.apache.poi:poi: < 3.10-beta1 → fixed in 3.10-beta1 • Maven org.apache.poi:poi-scratchpad: < 3.10-beta1 → fixed in 3.10-beta1

Description

The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Channel Definition Format (CDF) or Compound File Binary Format (CFBF) document.

Related

Alias · CVE (1)

  • CVE-2012-0213 The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References