Denial of Service in Apache POI
Summary
CVE-2014-9527: HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file. Affects libapache-poi-java versions < 3.10.1-2. Fixed in 3.10.1-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache POI is a Java library used for reading and writing Microsoft Office file formats, including PowerPoint files (PPT). It provides APIs to manipulate and extract data from these files. The libapache-poi-java package is a Debian package that includes Apache POI. This vulnerability affects versions of libapache-poi-java up to and including 3.10.1-2 in Debian 10, 11, 12, and 13.
Vulnerability Detail
The vulnerability, identified as CVE-2014-9527, exists in the HSLFSlideShow component of Apache POI. It allows remote attackers to trigger an infinite loop and deadlock by providing a crafted PPT file. This can lead to a denial of service (DoS) condition, causing the application using Apache POI to become unresponsive or crash. The vulnerability was published on January 6, 2015, and has a low urgency rating.
How To Fix
Minimum fixed version
3.10.1-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libapache-poi-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the fix by updating the libapache-poi-java package to a secure version.
Conclusion
The Denial of Service vulnerability in Apache POI can be mitigated by updating the libapache-poi-java package to version 3.11 or later. It is crucial to apply this fix to prevent potential crashes or unresponsiveness in applications using Apache POI. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for libapache-poi-java →
FAQ
Apache POI is a Java library for manipulating Microsoft Office file formats, including PowerPoint files.
The vulnerability can cause a denial of service (DoS) condition in applications using Apache POI, leading to unresponsiveness or crashes.
Versions up to and including 3.10.1-2 in Debian 10, 11, 12, and 13 are affected.
No, it is necessary to update the libapache-poi-java package to a secure version.
You can update the package using the package manager of your Debian distribution.
Related vulnerabilities
Recent vulnerabilities recorded for libapache-poi-java.
