content/security/cves/CVE-2021-40439.html (91 lines of code) (raw):
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>CVE-2021-40439</title>
</head>
<body>
<p>
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-40439">CVE-2021-40439</a>
</p>
<p>
<a href="https://www.openoffice.org/security/cves/CVE-2021-40439.html">Apache OpenOffice Advisory</a>
</p>
<p style="text-align:center; font-size:largest">
<strong>CVE-2021-40439 "Billion Laughs" fixed in Expat >=2.4.0</strong>
</p>
<p style="text-align:center; font-size:larger">
<strong>Fixed in Apache OpenOffice 4.1.11</strong>
</p>
<p>
<strong>Description</strong>
</p>
<p>
Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to
CVE-2013-0340 a "Billion Laughs" entity expansion denial of service attack and exploit via crafted
XML files. ODF files consist of a set of XML files.
expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer
uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service
(resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted
XML document, aka an XML External Entity (XXE) issue.
<br />
expat is a 3rd party library that is used in the Apache OpenOffice build process to make use of its
functions.
</p>
<p>
<strong>Severity: Moderate</strong>
</p>
<p>
There are no known exploits of this vulnerability.
<br />
A proof-of-concept demonstration exists.
</p>
<p>
Thanks to the reporter for discovering this issue
</p>
<p>
<strong>Vendor: The Apache Software Foundation</strong>
</p>
<p>
<strong>Versions Affected</strong>
</p>
<p>
All Apache OpenOffice versions 4.1.10 and older are affected.
<br />
OpenOffice.org versions may also be affected.
</p>
<p>
<strong>Mitigation</strong>
</p>
<p>
Install Apache OpenOffice 4.1.11 for the latest maintenance and cumulative security fixes.
Use the Apache OpenOffice <a href="https://www.openoffice.org/download/"> download page</a>.
</p>
<p>
<strong>Acknowledgments</strong>
</p>
<p>
The Apache OpenOffice Security Team thanks for pointing to this issue.
</p>
<p>
<strong>Further Information</strong>
</p>
<p>
For additional information and assistance, consult the
<a href="https://forum.openoffice.org/">Apache OpenOffice Community Forums</a>
or make requests to the
<a href="mailto:users@openoffice.apache.org">users@openoffice.apache.org</a>
public mailing list.
</p>
<p>
The latest information on Apache OpenOffice security bulletins can be found at the
<a href="https://www.openoffice.org/security/bulletin.html">Bulletin Archive page</a>.
</p>
<hr />
<p>
<a href="https://security.openoffice.org">Security Home</a>->
<a href="https://www.openoffice.org/security/bulletin.html">Bulletin</a>->
<a href="https://www.openoffice.org/security/cves/CVE-2021-40439.html">CVE-2021-40439</a>
</p>
</body>
</html>