The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Channel Definition Format (CDF) or Compound File Binary Format (CFBF) document.

Specially crafted CDF/CFBF files could trigger an out of memory condition

Updated jakarta-poi packages fix security vulnerability :

It was discovered that Apache POI, a Java implementation of the Microsoft Office file formats, would allocate arbitrary amounts of memory when processing crafted documents. This could impact the stability of the Java virtual machine (CVE-2012-0213).

- Update to 3.8 final

    - Add patch to fix CVE-2012-0213 (bugs 799078, 820788)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix CVE-2012-0213

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Apache POI, a Java implementation of the Microsoft Office file formats, would allocate arbitrary amounts of memory when processing crafted documents. This could impact the stability of the Java virtual machine.

ID	Name	Product	Family	Severity
74631	openSUSE Security Update : jakarta-poi (openSUSE-SU-2012:0654-1)	Nessus	SuSE Local Security Checks	medium
66106	Mandriva Linux Security Advisory : jakarta-poi (MDVSA-2013:094)	Nessus	Mandriva Local Security Checks	medium
61417	Fedora 17 : apache-poi-3.8-2.fc17 (2012-10835)	Nessus	Fedora Local Security Checks	medium
59203	Fedora 15 : apache-poi-3.7-7.fc15 (2012-7686)	Nessus	Fedora Local Security Checks	medium
59202	Fedora 16 : apache-poi-3.8-1.fc16 (2012-7683)	Nessus	Fedora Local Security Checks	medium
59062	Debian DSA-2468-1 : libjakarta-poi-java - unbounded memory allocation	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-0213

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium