Unscored CVE-2021-40439 EUVD-2021-27616GHSA-7579-q6rq-wf6r

Billion Laughs

Published Oct 7, 2021 · Updated Aug 4, 2024 · Assigned by apache

Vendor: Apache Software Foundation Product: Apache OpenOffice

Description

Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of service attack and exploit via crafted XML files. ODF files consist of a set of XML files. All versions of Apache OpenOffice up to 4.1.10 are subject to this issue. expat in version 4.1.11 is patched.

Affected products

Vendor	Product	Affected	Fixed
Apache Software Foundation	Apache OpenOffice	Apache OpenOffice – ≤ 4.1.10, OpenOffice.org – ≤ 3.4	—

References

https://lists.apache.org/thread.html/rfb2c193360436e230b85547e85a41bea0916916f96c501f5b6fc4702%40%3Cusers.openoffice.apache.org%3E
[announce] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs mailing-list
[oss-security] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs mailing-list