SB20250704104 - Input validation error in Apache POI

Description

This security bulletin contains information about 1 security vulnerability.

1) Input validation error (CVE-ID: CVE-2025-31672)

The vulnerability allows a remote attacker to manipulate file parsing behavior.

The vulnerability stems from the way Apache POI handles zip entries in OOXML format files. When duplicate file names (including paths) exist within the zip structure, different products may select different zip entries with the same name, leading to inconsistent data interpretation. A remote attacker can manipulate file parsing behavior through specially crafted OOXML files containing ZIP entries with duplicate file names. This manipulation can result in inconsistent data processing across different systems, potentially leading to security issues and data integrity concerns.

Remediation

Install update from vendor's website.

References

• http://www.openwall.com/lists/oss-security/2025/04/08/2
• https://bz.apache.org/bugzilla/show_bug.cgi?id=69620
• https://lists.apache.org/thread/k14w8vcjqy4h34hh5kzldko78kpylkq5
• https://security.netapp.com/advisory/ntap-20250523-0004/