CVE-2014-3529
Fixed in a distro release EPSS 13%
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Products: apache poi
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.poi:poi | 3.10.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libapache-poi-java | 3.10.1-1 |
| Debian 13 | libapache-poi-java | 3.10.1-1 |
| Debian 14 | libapache-poi-java | 3.10.1-1 |