CVE-2012-0213 Denial of Service in Apache POI

What is CVE-2012-0213?

CVE-2012-0213 is a medium-severity denial of service vulnerability in n/a, published on 7 Aug 2012. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

The UnhandledDataStructure function in hwpf/model/UnhandledDataStructure.java in Apache POI 3.8 and earlier allows remote attackers to cause a denial of service (OutOfMemoryError exception and possibly JVM destabilization) via a crafted length value in a Channel Definition Format (CDF) or Compound File Binary Format (CFBF) document.

Weakness: CWE-399

Which versions are affected by CVE-2012-0213?

4 open source packages ship an affected version, including org.apache.poi:poi and org.apache.poi:poi-scratchpad. It affects 1 product.

Products include Apache Poi.

How do I fix CVE-2012-0213?

Upgrade org.apache.poi:poi to 3.10-beta1 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2012-0213 being exploited?

There is no known exploitation of CVE-2012-0213 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2017-12626 Denial of Service in Apache POI High 7.5
• CVE-2022-26336 A carefully crafted TNEF file can cause an out of memory exception Medium 5.5
• CVE-2019-12415 Improper Restriction of XML External Entity Reference in Apache POI Medium 5.5
• CVE-2017-5644 Improper Restriction of Recursive Entity References in DTDs in Apache POI Medium 5.5
• CVE-2016-5000 Apache POI's XLSX2CSV Example XML External Entity (XXE) Vulnerability Medium 5.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DSA-2468-1, GHSA-jqx5-h2hw-5q4f.