Not rated
CVE-2021-40439 Apache OpenOffice has a dependency on expat software
Description
Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of service attack and exploit via crafted XML files. ODF files consist of a set of XML files. All versions of Apache OpenOffice up to 4.1.10 are subject to this issue. expat in version 4.1.11 is patched.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Apache OpenOffice 4.1 | earliest → 4.1.10 | No fix stated |
| Apache OpenOffice 3.4 | earliest → 3.4 | No fix stated |
References
- lists.apache.org lists.apache.org
- [announce] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs lists.apache.org
- [oss-security] 20211007 CVE-2021-40439: Apache OpenOffice: Billion Laughs www.openwall.com
Timeline
- Published
- Last modified
Other CVEs of Apache OpenOffice
The 39 CVEs of Apache OpenOffice →
CVE-2026-59267
Apache OpenOffice: Heap Buffer Overflow in DXF LWPOLYLINE import could cause memory corruption
5.8
Medium
CVE-2026-90632
Apache OpenOffice: Local file inclusion via GStreamer plugin
Not rated
CVE-2026-90634
Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files
Not rated
CVE-2026-90631
Apache OpenOffice: Remote document loaded without prompt, possibiy leaking environment variables
Not rated