CVE-2012-0213 Denial of Service in Apache POI
MediumCVSS 5.0
EPSS 7.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Channel Definition Format (CDF) or Compound File Binary Format (CFBF) document.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.poi/poi(Maven) | < 3.10-beta1 | 3.10-beta1 |
| org.apache.poi/poi(Maven) | = 3.0-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.0.1-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.0.2-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.0.2-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.0.2-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.1-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.1-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.1-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.2-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-beta3 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-beta4 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-beta5 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-beta6 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.6 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.7 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.7-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.7-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.7-beta3 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8-beta3 | No fix listed |
Show 90 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.poi/poi(Maven) | = 3.8-beta4 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8-beta5 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.9 | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | < 3.10-beta1 | 3.10-beta1 |
| org.apache.poi/poi-scratchpad(Maven) | = 3.0.1-FINAL | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.0.2-FINAL | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.0.2-beta1 | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.0.2-beta2 | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.1-FINAL | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.1-beta1 | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.1-beta2 | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.2-FINAL | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.5-FINAL | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.5-beta1 | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.5-beta3 | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.5-beta4 | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.5-beta5 | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.5-beta6 | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.6 | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.7 | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.7-beta1 | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.7-beta2 | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.7-beta3 | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.8 | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.8-beta1 | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.8-beta2 | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.8-beta3 | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.8-beta4 | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.8-beta5 | No fix listed |
| org.apache.poi/poi-scratchpad(Maven) | = 3.9 | No fix listed |
| apache poi | <= 3.8 | No fix listed |
| apache poi | = 0.1 | No fix listed |
| apache poi | = 0.2 | No fix listed |
| apache poi | = 0.3 | No fix listed |
| apache poi | = 0.4 | No fix listed |
| apache poi | = 0.5 | No fix listed |
| apache poi | = 0.6 | No fix listed |
| apache poi | = 0.7 | No fix listed |
| apache poi | = 0.10.0 | No fix listed |
| apache poi | = 0.11.0 | No fix listed |
| apache poi | = 0.12.0 | No fix listed |
| apache poi | = 0.13.0 | No fix listed |
| apache poi | = 0.14.0 | No fix listed |
| apache poi | = 1.0.0 | No fix listed |
| apache poi | = 1.0.1 | No fix listed |
| apache poi | = 1.0.2 | No fix listed |
| apache poi | = 1.1.0 | No fix listed |
| apache poi | = 1.2.0 | No fix listed |
| apache poi | = 1.5 | No fix listed |
| apache poi | = 1.5.1 | No fix listed |
| apache poi | = 1.7-dev | No fix listed |
| apache poi | = 1.8-dev | No fix listed |
| apache poi | = 1.10-dev | No fix listed |
| apache poi | = 2.0 | No fix listed |
| apache poi | = 2.0-pre1 | No fix listed |
| apache poi | = 2.0-pre2 | No fix listed |
| apache poi | = 2.0-pre3 | No fix listed |
| apache poi | = 2.0-rc1 | No fix listed |
| apache poi | = 2.0-rc2 | No fix listed |
| apache poi | = 2.5 | No fix listed |
| apache poi | = 2.5.1 | No fix listed |
| apache poi | = 3.0 | No fix listed |
| apache poi | = 3.0-alpha1 | No fix listed |
| apache poi | = 3.0-alpha2 | No fix listed |
| apache poi | = 3.0-alpha3 | No fix listed |
| apache poi | = 3.0.1 | No fix listed |
| apache poi | = 3.0.2 | No fix listed |
| apache poi | = 3.0.2-beta1 | No fix listed |
| apache poi | = 3.0.2-beta2 | No fix listed |
| apache poi | = 3.1 | No fix listed |
| apache poi | = 3.1-beta1 | No fix listed |
| apache poi | = 3.1-beta2 | No fix listed |
| apache poi | = 3.2 | No fix listed |
| apache poi | = 3.5 | No fix listed |
| apache poi | = 3.5-beta1 | No fix listed |
| apache poi | = 3.5-beta2 | No fix listed |
| apache poi | = 3.5-beta3 | No fix listed |
| apache poi | = 3.5-beta4 | No fix listed |
| apache poi | = 3.5-beta5 | No fix listed |
| apache poi | = 3.5-beta6 | No fix listed |
| apache poi | = 3.6 | No fix listed |
| apache poi | = 3.7 | No fix listed |
| apache poi | = 3.7-beta1 | No fix listed |
| apache poi | = 3.7-beta2 | No fix listed |
| apache poi | = 3.7-beta3 | No fix listed |
| apache poi | = 3.8-beta1 | No fix listed |
| apache poi | = 3.8-beta2 | No fix listed |
| apache poi | = 3.8-beta3 | No fix listed |
| apache poi | = 3.8-beta4 | No fix listed |
| apache poi | = 3.8-beta5 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- bugzilla.redhat.com
- github.com product
- wiki.mageia.org
- FEDORA-2012-10835 vendor-advisory
- www-01.ibm.com
- DSA-2468 vendor-advisory
- github.com
- RHSA-2012:1232 vendor-advisory
- 49040 third-party-advisory vendor-advisory
- 50549 third-party-advisory
- MDVSA-2013:094 vendor-advisory
- 53487 vdb-entry