CVE-2012-0213: Medium severity apache poi vulnerability
A flaw was found in the way Apache POI, the Java API for Microsoft Office file formats, handles memory when processing certain Channel Definition Format (CDF) / Compound File Binary Format (CFBF) documents. Apache POI allocates arrays with arbitrary sizes specified in the document. A remote attacker could exploit this flaw by providing a specially-crafted CDF / CFBF file to an application using Apache POI, leading to an to OutOfMemoryError exception in the current thread, or potentially destabilization of the whole Java Virtual Machine instance.
Other sources
The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Channel Definition Format (CDF) or Compound File Binary Format (CFBF) document.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-0213?
CVE-2012-0213 has a medium severity rating, making it a notable concern for affected users.
How do I fix CVE-2012-0213?
To mitigate CVE-2012-0213, upgrade to Apache POI version 3.10-beta1 or later.
Which versions of Apache POI are affected by CVE-2012-0213?
CVE-2012-0213 affects Apache POI versions from 0.1 up to and including 3.8.
What type of vulnerability is CVE-2012-0213?
CVE-2012-0213 is a memory handling flaw that can lead to potential information disclosure.
Can CVE-2012-0213 be exploited remotely?
Yes, CVE-2012-0213 can be exploited remotely by attackers through specially crafted documents.