New subject: [Bug 1434522] CVE-2017-5644 apache-poi: XML entity expansion via specially crafted OOXML file

21 Mar 2017


      https://bugzilla.redhat.com/show_bug.cgi?id=1434522
Bug ID: 1434522
           Summary: CVE-2017-5644 apache-poi: XML entity expansion via
                    specially crafted OOXML file
           Product: Security Response
         Component: vulnerability
          Keywords: Security
          Severity: medium
          Priority: medium
          Assignee: security-response-team@redhat.com
          Reporter: anemec@redhat.com
                CC: java-sig-commits@lists.fedoraproject.org,
                    mat.booth@redhat.com, puntogil@libero.it
Apache POI in versions prior to release 3.15 allows remote attackers to cause a
denial of service (CPU consumption) via a specially crafted OOXML file, aka an
XML Entity Expansion (XEE) attack.
References:
http://www.openwall.com/lists/oss-security/2017/03/20/9
-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug 1434522] New: CVE-2017-5644 apache-poi: XML entity expansion via specially crafted OOXML file