title: Billion Laughs
description: Apache OpenOffice has a dependency on expat software. Versions prior to 2.1.0 were subject to CVE-2013-0340 a "Billion Laughs" entity expansion denial of service attack and exploit via crafted XML files. ODF files consist of a set of XML files. All versions of Apache OpenOffice up to 4.1.10 are subject to this issue. expat in version 4.1.11 is patched.
problem types: CWE-611 Improper Restriction of XML External Entity Reference
affected:
{
product: Apache OpenOffice
vendor: Apache Software Foundation
versions:
lessThanOrEqual: 4.1.10, status: affected, version: Apache OpenOffice, versionType: custom
lessThanOrEqual: 3.4, status: affected, version: OpenOffice.org, versionType: custom
}
metrics:
other: [
content: {'other': 'medium'}
type: unknown
]