CVE-2014-3574 Improper Input Validation in Apache POI
MediumCVSS 4.3
EPSS 7.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.poi/poi(Maven) | < 3.10.1 | 3.10.1 |
| org.apache.poi/poi(Maven) | = 3.0-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.0.1-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.0.2-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.0.2-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.0.2-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.1-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.1-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.1-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.10-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.10-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.10-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.2-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-beta3 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-beta4 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-beta5 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-beta6 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.6 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.7 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.7-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.7-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.7-beta3 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8 | No fix listed |
Show 76 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.poi/poi(Maven) | = 3.8-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8-beta3 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8-beta4 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8-beta5 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.9 | No fix listed |
| org.apache.poi/poi(Maven) | >= 3.11-beta1, < 3.11-beta2 | 3.11-beta2 |
| org.apache.poi/poi(Maven) | = 3.11-beta1 | No fix listed |
| debian/libapache-poi-java(Debian:12) | < 3.10.1-1 | 3.10.1-1 |
| debian/libapache-poi-java(Debian:13) | < 3.10.1-1 | 3.10.1-1 |
| debian/libapache-poi-java(Debian:14) | < 3.10.1-1 | 3.10.1-1 |
| apache poi | <= 3.10 | No fix listed |
| apache poi | = 0.1 | No fix listed |
| apache poi | = 0.2 | No fix listed |
| apache poi | = 0.3 | No fix listed |
| apache poi | = 0.4 | No fix listed |
| apache poi | = 0.5 | No fix listed |
| apache poi | = 0.6 | No fix listed |
| apache poi | = 0.7 | No fix listed |
| apache poi | = 0.10.0 | No fix listed |
| apache poi | = 0.11.0 | No fix listed |
| apache poi | = 0.12.0 | No fix listed |
| apache poi | = 0.13.0 | No fix listed |
| apache poi | = 0.14.0 | No fix listed |
| apache poi | = 1.0.0 | No fix listed |
| apache poi | = 1.0.1 | No fix listed |
| apache poi | = 1.0.2 | No fix listed |
| apache poi | = 1.1.0 | No fix listed |
| apache poi | = 1.2.0 | No fix listed |
| apache poi | = 1.5 | No fix listed |
| apache poi | = 1.5.1 | No fix listed |
| apache poi | = 1.7-dev | No fix listed |
| apache poi | = 1.8-dev | No fix listed |
| apache poi | = 1.10-dev | No fix listed |
| apache poi | = 2.0 | No fix listed |
| apache poi | = 2.0-pre1 | No fix listed |
| apache poi | = 2.0-pre2 | No fix listed |
| apache poi | = 2.0-pre3 | No fix listed |
| apache poi | = 2.0-rc1 | No fix listed |
| apache poi | = 2.0-rc2 | No fix listed |
| apache poi | = 2.5 | No fix listed |
| apache poi | = 2.5.1 | No fix listed |
| apache poi | = 3.0 | No fix listed |
| apache poi | = 3.0-alpha1 | No fix listed |
| apache poi | = 3.0-alpha2 | No fix listed |
| apache poi | = 3.0-alpha3 | No fix listed |
| apache poi | = 3.0.1 | No fix listed |
| apache poi | = 3.0.2 | No fix listed |
| apache poi | = 3.0.2-beta1 | No fix listed |
| apache poi | = 3.0.2-beta2 | No fix listed |
| apache poi | = 3.1 | No fix listed |
| apache poi | = 3.1-beta1 | No fix listed |
| apache poi | = 3.1-beta2 | No fix listed |
| apache poi | = 3.2 | No fix listed |
| apache poi | = 3.5 | No fix listed |
| apache poi | = 3.5-beta1 | No fix listed |
| apache poi | = 3.5-beta2 | No fix listed |
| apache poi | = 3.5-beta3 | No fix listed |
| apache poi | = 3.5-beta4 | No fix listed |
| apache poi | = 3.5-beta5 | No fix listed |
| apache poi | = 3.5-beta6 | No fix listed |
| apache poi | = 3.6 | No fix listed |
| apache poi | = 3.7 | No fix listed |
| apache poi | = 3.7-beta1 | No fix listed |
| apache poi | = 3.7-beta2 | No fix listed |
| apache poi | = 3.7-beta3 | No fix listed |
| apache poi | = 3.8 | No fix listed |
| apache poi | = 3.8-beta1 | No fix listed |
| apache poi | = 3.8-beta2 | No fix listed |
| apache poi | = 3.8-beta3 | No fix listed |
| apache poi | = 3.8-beta4 | No fix listed |
| apache poi | = 3.8-beta5 | No fix listed |
| apache poi | = 3.9 | No fix listed |
| apache poi | = 3.10-beta1 | No fix listed |
| apache poi | = 3.10-beta2 | No fix listed |
| apache poi | = 3.11-beta1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- apache-poi-cve20143574-dos(95768) vdb-entry
- github.com product
- lucene.apache.org patch vendor-advisory
- svn.apache.org
- svn.apache.org
- svn.apache.org
- svn.apache.org
- poi.apache.org
- RHSA-2014:1370 vendor-advisory
- RHSA-2014:1398 vendor-advisory
- RHSA-2014:1399 vendor-advisory
- RHSA-2014:1400 vendor-advisory
- www-01.ibm.com
- www.apache.org vendor-advisory
- github.com
- Debian Security Tracker CVE-2014-3574 vendor-advisory
- 59943 third-party-advisory
- 60419 third-party-advisory
- 61766 third-party-advisory
- 69648 vdb-entry