A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.

Affected: Maven: org.apache.poi:poi-scratchpad

A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.

elasticsearch: not properly preserving security permissions when executing complex queries may lead to information disclosure tomcat: deserialization flaw in session persistence storage leading to RCE junit4: TemporaryFolder is shared between all users across system which could result in information disclosure wildfly-core: memory leak in WildFly host-controller in domain mode while not able to reconnect to domain-controller kotlin: vulnerable Java API was used for temporary file and folder creation which could result in information disclosure jackson-databind: denial of service via a large depth of nested objects mysql-connector-java: unauthorized access to critical undertow: potential security issue in flow control over HTTP/2 may lead to DOS wildfly-elytron: possible timing attack in ScramServer wildfly-core: Invalid Sensitivity Classification of Vault Expression nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes undertow: client side invocation timeout raised when calling over HTTP2 kubernetes-client: Insecure deserialization in unmarshalYaml method springframework: Additional Log Injection in Spring Framework (follow-up to CVE-2021-22096) springframework: malicious input leads to insertion of additional log entries spring-security: Denial-of-Service (DoS) attack via initiation of Authorization Request protobuf-java: potential DoS in the parsing procedure for binary data google-oauth-client: Token signature not verified tomcat: Inf…

Affected: Ubuntu:Pro:14.04:LTS: lucene-solr, Ubuntu:16.04:LTS: libapache-poi-java, Ubuntu:Pro:16.04:LTS: lucene-solr, Ubuntu:18.04:LTS: libapache-poi-java, Ubuntu:Pro:18.04:LTS: lucene-solr, Ubuntu:20.04:LTS: libapache-poi-java, Ubuntu:20.04:LTS: lucene-solr, Ubuntu:22.04:LTS: libapache-poi-java, Ubuntu:22.04:LTS: lucene-solr, Ubuntu:24.04:LTS: libapache-poi-java and 5 more

A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.

Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat FUSE ausnutzen, um vertrauliche Informationen offenzulegen, beliebigen Code auszuführen, einen Denial of Service Zustand herbeizuführen, Sicherheitsmaßnahmen zu umgehen, Daten und Informationen zu manipulieren und seine Privilegien zu erweitern.