CVE-2014-3574
Fixed in a distro release EPSS 7%
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
Products: apache poi
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.apache.poi:poi | 3.10.1 |
| Maven | org.apache.poi:poi | 3.11-beta2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libapache-poi-java | 3.10.1-1 |
| Debian 13 | libapache-poi-java | 3.10.1-1 |
| Debian 14 | libapache-poi-java | 3.10.1-1 |