Homepage

CVE-2014-3574 The advisory has been revoked - it doesn't affect any version of package libapache-poi-java  (opens in a new tab)

Threat Intelligence

EPSS
7.11% (94th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1810-LIBAPACHEPOIJAVA-631271
  • published4 Sept 2014
  • disclosed4 Sept 2014
Report a new vulnerability Found a mistake?

Introduced: 4 Sep 2014

CVE-2014-3574  (opens in a new tab)

Amendment

The Ubuntu security team deemed this advisory irrelevant for Ubuntu:18.10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libapache-poi-java package and not the libapache-poi-java package as distributed by Ubuntu.

Apache POI before 3.10.1 and 3.11.x before 3.11-beta2 allows remote attackers to cause a denial of service (CPU consumption and crash) via a crafted OOXML file, aka an XML Entity Expansion (XEE) attack.

References