CVE-2022-26336

Description

A shortcoming in the HMEF package of poi-scratchpad (Apache POI) allows an attacker to cause an Out of Memory exception. This package is used to read TNEF files (Microsoft Outlook and Microsoft Exchange Server). If an application uses poi-scratchpad to parse TNEF files and the application allows untrusted users to supply them, then a carefully crafted file can cause an Out of Memory exception. This issue affects poi-scratchpad version 5.2.0 and prior versions. Users are recommended to upgrade to poi-scratchpad 5.2.1.

Risk Information

Base Score

5.5

MODERATE

Vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS Score

Exploitation Probability

0.042

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2022-26336 are fixed in Apache-poi-scratchpad 5.2.1	Windows
Multiple Vulnerabilities are affected in Netapp Active Iq Unified Manager 2.3	Windows
Multiple Vulnerabilities are affected in IBM Planning Analytics Local 2.0	Windows
Multiple Vulnerabilities are affected in IBM Planning Analytics Local 2.1	Windows
Vulnerabilities CVE-2022-26336 are fixed in Apache-poi-scratchpad for Linux 5.2.1	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234