NetSight
IP …
medium5.5

CVE-2020-9489

A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser.

Impact

A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or infinite loops in Tika's ICNSParser, MP3Parser, MP4Parser, SAS7BDATParser, OneNoteParser and ImageParser. Apache Tika users should upgrade to 1.24.1 or later. The vulnerabilities in the MP4Parser were partially fixed by upgrading the com.googlecode:isoparser:1.1.22 dependency to org.tallison:isoparser:1.9.41.2. For unrelated security reasons, we upgraded org.apache.cxf to 3.3.6 as part of the 1.24.1 release.

Affected products

VendorProductAffected versions
ApacheTika
Version 1.24
OracleFlexcube Private Banking
Versions 12.0.0, 12.1.0
OraclePrimavera Unifier
from 17.7 through 17.12
Versions 16.1, 16.2, 18.8, 19.12
OracleWebcenter Portal
Versions 12.2.1.3.0, 12.2.1.4.0
OracleCommunications Messaging Server
Version 8.1

Weakness classification

CWE-835

References