Все бюллетени/sisyphus/ALT-PU-2025-16974-1
ALT-PU-2025-16974-1

Обновление пакета apache-poi в ветке sisyphus

Версия5.4.1-alt1
Задание#389146
Опубликовано2025-07-07
Макс. серьёзностьMEDIUM
Серьёзность:

Закрытые проблемы (7)

BDU:2020-00970
MEDIUM5.5

Уязвимость набора инструментов XSSFExportToXml Java-библиотеки для чтения и записи документов MS Office Apache POI, позволяющая нарушителю получить несанкционированный доступ на чтение файлов

Опубликовано: 2020-03-12Изменено: 2021-02-25
CVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0СРЕДНЯЯ 4.6
CVSS:2.0/AV:L/AC:L/Au:S/C:C/I:N/A:N
Ссылки
CVE-2019-12415
MEDIUM5.5

In Apache POI up to 4.1.0, when using the tool XSSFExportToXml to convert user-provided Microsoft Excel documents, a specially crafted document can allow an attacker to read files from the local filesystem or from internal network resources via XML External Entity (XXE) Processing.

Опубликовано: 2019-10-23Изменено: 2024-11-21
CVSS 2.0НИЗКАЯ 2.1
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:N/A:N
CVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Ссылки
CVE-2022-26336
MEDIUM5.5

A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.

Опубликовано: 2022-03-04Изменено: 2024-11-21
CVSS 2.0СРЕДНЯЯ 4.3
CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:N/A:P
CVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Ссылки
CVE-2025-31672
MEDIUM5.3

Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names (including the path) in the zip. In this case, products reading the affected file could read different data because 1 of the zip entries with the duplicate name is selected over another but different products may choose a different zip entry. This issue affects Apache POI poi-ooxml before 5.4.0. poi-ooxml 5.4.0 has a check that throws an exception if zip entries with duplicate file names are found in the input file. Users are recommended to upgrade to version poi-ooxml 5.4.0, which fixes the issue. Please read https://poi.apache.org/security.html for recommendations about how to use the POI libraries securely.

Опубликовано: 2025-04-09Изменено: 2025-07-15
CVSS 3.xСРЕДНЯЯ 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Ссылки
GHSA-9jwc-q6j3-8g9g
MEDIUM5.5

Improper Restriction of XML External Entity Reference in Apache POI

Опубликовано: 2022-05-24Изменено: 2022-11-17
CVSS 3.xСРЕДНЯЯ 5.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Ссылки
GHSA-gmg8-593g-7mv3
MEDIUM6.9

Apache POI OOXML Vulnerable to Improper Input Validation in OOXML File Parsing

Опубликовано: 2025-04-09Изменено: 2025-05-23
CVSS 3.x
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 4.0
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Ссылки