// For flags

CVE-2021-40439

Billion Laughs

Severity Score

6.5
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of service attack and exploit via crafted XML files. ODF files consist of a set of XML files. All versions of Apache OpenOffice up to 4.1.10 are subject to this issue. expat in version 4.1.11 is patched.

Apache OpenOffice presenta una dependencia del software expat. Las versiones anteriores a 2.1.0, estaban sujetas a CVE-2013-0340 un ataque de denegación de servicio de expansión de la entidad "Billion Laughs" y su explotación por medio de archivos XML diseñados. Los archivos ODF consisten en un conjunto de archivos XML. Todas las versiones de Apache OpenOffice hasta 4.1.10 están sujetas a este problema. expat en su versión 4.1.11 está parcheada

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2021-09-02 CVE Reserved
  • 2021-10-07 CVE Published
  • 2024-05-13 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-611: Improper Restriction of XML External Entity Reference
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Apache
Search vendor "Apache"
 Openoffice
Search vendor "Apache" for product "Openoffice"
 <= 4.1.10
Search vendor "Apache" for product "Openoffice" and version " <= 4.1.10"
-
Affected