CVE-2014-9527 Loop with Unreachable Exit Condition in Apache POI
MediumCVSS 5.0
EPSS 6.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.poi/poi(Maven) | < 3.11 | 3.11 |
| debian/libapache-poi-java(Debian:12) | < 3.10.1-2 | 3.10.1-2 |
| debian/libapache-poi-java(Debian:14) | < 3.10.1-2 | 3.10.1-2 |
| debian/libapache-poi-java(Debian:13) | < 3.10.1-2 | 3.10.1-2 |
| org.apache.poi/poi(Maven) | = 3.0-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.0.1-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.0.2-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.0.2-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.0.2-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.1-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.1-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.1-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.10-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.10-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.10-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.10.1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.11-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.11-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.11-beta3 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.2-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-FINAL | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-beta3 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-beta4 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.5-beta5 | No fix listed |
Show 15 more
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.poi/poi(Maven) | = 3.5-beta6 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.6 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.7 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.7-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.7-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.7-beta3 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8-beta1 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8-beta2 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8-beta3 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8-beta4 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.8-beta5 | No fix listed |
| org.apache.poi/poi(Maven) | = 3.9 | No fix listed |
| fedoraproject fedora | = 20 | No fix listed |
| apache poi | <= 3.11 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2016:1135 vendor-advisory
- issues.apache.org
- FEDORA-2015-2090 vendor-advisory
- poi.apache.org
- 61953 third-party-advisory
- www-01.ibm.com
- github.com
- Debian Security Tracker CVE-2014-9527 vendor-advisory
- bugs.debian.org issue-tracking
- 77726 vdb-entry