CVE-2014-3574: XEE
Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.
Other sources
IssueDescription:
It was found that Apache POI would expand an unlimited number of entities in OOXML documents. A remote attacker able to supply OOXML documents that are parsed by Apache POI could use this flaw to trigger a denial of service attack via excessive CPU and memory consumption.
— Red Hat
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2014-3574?
CVE-2014-3574 is classified as a denial of service vulnerability due to CPU consumption and crashes.
How do I fix CVE-2014-3574?
To mitigate CVE-2014-3574, upgrade to Apache POI version 3.10.1 or later, or to 3.11-beta2 or later.
What versions of Apache POI are affected by CVE-2014-3574?
CVE-2014-3574 affects Apache POI versions prior to 3.10.1 and 3.11-beta2.
Can CVE-2014-3574 be exploited remotely?
Yes, CVE-2014-3574 can be exploited remotely by using a crafted OOXML file.
What type of attack does CVE-2014-3574 represent?
CVE-2014-3574 represents an XML Entity Expansion (XEE) attack.