REDHAT-BUG-799078: Medium severity apache poi vulnerability

Published Mar 1, 2012

Updated

A flaw was found in the way Apache POI, the Java API for Microsoft Office file formats, handles memory when processing certain Channel Definition Format (CDF) / Compound File Binary Format (CFBF) documents. Apache POI allocates arrays with arbitrary sizes specified in the document. A remote attacker could exploit this flaw by providing a specially-crafted CDF / CFBF file to an application using Apache POI, leading to an to OutOfMemoryError exception in the current thread, or potentially destabilization of the whole Java Virtual Machine instance.

Affected Software

1 affected component

Apache POI

Event History

Mar 1, 2012

Data Sourced

via Red Hat·06:10 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-799078?

The severity of REDHAT-BUG-799078 is considered high due to the potential for remote code execution.

How do I fix REDHAT-BUG-799078?

To fix REDHAT-BUG-799078, update Apache POI to the latest version that addresses this vulnerability.

Who is affected by REDHAT-BUG-799078?

Users and applications utilizing Apache POI for processing CDF/CFBF documents are affected by REDHAT-BUG-799078.

What types of attacks can REDHAT-BUG-799078 facilitate?

REDHAT-BUG-799078 can facilitate remote code execution attacks through maliciously crafted CDF/CFBF documents.

When was REDHAT-BUG-799078 discovered?

REDHAT-BUG-799078 was filed on July 24, 2012.