| <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> |
| <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> |
| <head> |
| <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /> |
| <title>CVE-2021-40439</title> |
| </head> |
| |
| <body> |
| <p> |
| <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-40439">CVE-2021-40439</a> |
| </p> |
| <p> |
| <a href="https://www.openoffice.org/security/cves/CVE-2021-40439.html">Apache OpenOffice Advisory</a> |
| </p> |
| <p style="text-align:center; font-size:largest"> |
| <strong>CVE-2021-40439 "Billion Laughs" fixed in Expat >=2.4.0</strong> |
| </p> |
| <p style="text-align:center; font-size:larger"> |
| <strong>Fixed in Apache OpenOffice 4.1.11</strong> |
| </p> |
| <p> |
| <strong>Description</strong> |
| </p> |
| <p> |
| Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to |
| CVE-2013-0340 a "Billion Laughs" entity expansion denial of service attack and exploit via crafted |
| XML files. ODF files consist of a set of XML files. |
| expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer |
| uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service |
| (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted |
| XML document, aka an XML External Entity (XXE) issue. |
| <br /> |
| expat is a 3rd party library that is used in the Apache OpenOffice build process to make use of its |
| functions. |
| </p> |
| <p> |
| <strong>Severity: Moderate</strong> |
| </p> |
| <p> |
| There are no known exploits of this vulnerability. |
| <br /> |
| A proof-of-concept demonstration exists. |
| </p> |
| <p> |
| Thanks to the reporter for discovering this issue |
| </p> |
| <p> |
| <strong>Vendor: The Apache Software Foundation</strong> |
| </p> |
| <p> |
| <strong>Versions Affected</strong> |
| </p> |
| <p> |
| All Apache OpenOffice versions 4.1.10 and older are affected. |
| <br /> |
| OpenOffice.org versions may also be affected. |
| </p> |
| <p> |
| <strong>Mitigation</strong> |
| </p> |
| <p> |
| Install Apache OpenOffice 4.1.11 for the latest maintenance and cumulative security fixes. |
| Use the Apache OpenOffice <a href="https://www.openoffice.org/download/"> download page</a>. |
| </p> |
| <p> |
| <strong>Acknowledgments</strong> |
| </p> |
| <p> |
| The Apache OpenOffice Security Team thanks for pointing to this issue. |
| </p> |
| <p> |
| <strong>Further Information</strong> |
| </p> |
| <p> |
| For additional information and assistance, consult the |
| <a href="https://forum.openoffice.org/">Apache OpenOffice Community Forums</a> |
| or make requests to the |
| <a href="mailto:users@openoffice.apache.org">users@openoffice.apache.org</a> |
| public mailing list. |
| </p> |
| <p> |
| The latest information on Apache OpenOffice security bulletins can be found at the |
| <a href="https://www.openoffice.org/security/bulletin.html">Bulletin Archive page</a>. |
| </p> |
| <hr /> |
| <p> |
| <a href="https://security.openoffice.org">Security Home</a>-> |
| <a href="https://www.openoffice.org/security/bulletin.html">Bulletin</a>-> |
| <a href="https://www.openoffice.org/security/cves/CVE-2021-40439.html">CVE-2021-40439</a> |
| </p> |
| </body> |
| </html> |
