CVE-2014-9527: Medium severity fedoraproject fedora vulnerability
A denial of service flaw was found in the way the HSLFSlideShow class implementation in Apache POI handled certain PPT files. A remote attacker could submit a specially crafted PPT file that would cause Apache POI to hang indefinitely.
Upstream Issue:
https://issues.apache.org/bugzilla/showbug.cgi?id=57272
Upstream Fix:
https://svn.apache.org/viewvc?view=revision&revision=1643680
Other sources
HSLFSlideShow in Apache POI before 3.11 allows remote attackers to cause a denial of service (infinite loop and deadlock) via a crafted PPT file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9527?
CVE-2014-9527 is classified as a denial of service vulnerability which can lead to system resource exhaustion.
How do I fix CVE-2014-9527?
To fix CVE-2014-9527, upgrade Apache POI to version 3.11 or later.
What software is affected by CVE-2014-9527?
CVE-2014-9527 affects Apache POI versions prior to 3.11, as well as specific installations on Fedora 20.
What type of attack does CVE-2014-9527 enable?
CVE-2014-9527 enables remote attackers to execute a denial of service attack via crafted PPT files.
Can CVE-2014-9527 lead to data loss?
While CVE-2014-9527 primarily causes a denial of service, it does not directly lead to data loss but may disrupt service availability.