Moderate severityNVD Advisory· Published Sep 4, 2014· Updated Jun 17, 2026
CVE-2014-3529
CVE-2014-3529
Description
The OPC SAX setup in Apache POI before 3.10.1 allows remote attackers to read arbitrary files via an OpenXML file containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
org.apache.poi:poiMaven | < 3.10.1 | 3.10.1 |
Affected products
65cpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*+ 63 more
- cpe:2.3:a:apache:poi:*:*:*:*:*:*:*:*range: <=3.10
- cpe:2.3:a:apache:poi:0.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:0.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:0.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:0.12.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:0.13.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:0.14.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:0.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:0.3:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:0.4:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:0.5:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:0.6:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:0.7:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:1.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:1.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:1.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:1.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:1.10:dev:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:1.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:1.5:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:1.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:1.7:dev:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:1.8:dev:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:2.0:pre1:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:2.0:pre2:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:2.0:pre3:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:2.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:2.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:2.5:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:2.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.0.2:beta1:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.0.2:beta2:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.0:alpha2:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.0:alpha3:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.1:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.10:beta1:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.10:beta2:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.1:beta1:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.1:beta2:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.2:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.5:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.5:beta1:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.5:beta2:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.5:beta3:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.5:beta4:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.5:beta5:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.5:beta6:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.6:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.7:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.7:beta1:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.7:beta2:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.7:beta3:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.8:*:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.8:beta1:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.8:beta2:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.8:beta3:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.8:beta4:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.8:beta5:*:*:*:*:*:*
- cpe:2.3:a:apache:poi:3.9:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
21- github.com/advisories/GHSA-q56h-jjj6-52mfghsaADVISORY
- lucene.apache.org/solr/solrnews.htmlnvdVendor AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2014-3529ghsaADVISORY
- poi.apache.org/changes.htmlnvdWEB
- rhn.redhat.com/errata/RHSA-2014-1370.htmlnvdWEB
- rhn.redhat.com/errata/RHSA-2014-1398.htmlnvdWEB
- rhn.redhat.com/errata/RHSA-2014-1399.htmlnvdWEB
- rhn.redhat.com/errata/RHSA-2014-1400.htmlnvdWEB
- www-01.ibm.com/support/docview.wssnvdWEB
- www.apache.org/dist/poi/release/RELEASE-NOTES.txtnvdWEB
- exchange.xforce.ibmcloud.com/vulnerabilities/95770nvdWEB
- github.com/apache/poi/commit/103b45073c7b504236588b3acc146530205af53cghsaWEB
- github.com/apache/poi/commit/236c3c52a9b90688b2e57ec503559409e29f33edghsaWEB
- github.com/apache/poi/commit/6050a68d5adfb4ffef1edb778add09bcee32d1c3ghsaWEB
- github.com/apache/poi/commit/d72bd78c19dfb7b57395a66ae8d9269d59a87bd2ghsaWEB
- github.com/apache/poi/commit/eabb6a924be24abb879372d0bc967e0d316b2cf8ghsaWEB
- secunia.com/advisories/59943nvd
- secunia.com/advisories/60419nvd
- secunia.com/advisories/61766nvd
- www.securityfocus.com/bid/69647nvd
- www.securityfocus.com/bid/78018nvd
News mentions
0No linked articles in our index yet.