oss-sec mailing list archives

CVE-2021-40439: Apache OpenOffice: Billion Laughs

From: Dave Fisher <wave () apache org>
Date: Thu, 07 Oct 2021 15:20:29 +0000

Severity: medium

Description:

Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion 
Laughs" entity expansion denial of service attack and exploit via crafted XML files. ODF files consist of a set of XML 
files.

All versions of Apache OpenOffice up to 4.1.10 are subject to this issue.

expat in version 4.1.11 is patched.

Current thread:

CVE-2021-40439: Apache OpenOffice: Billion Laughs Dave Fisher (Oct 07)