p PatchFirst

CVE-2014-2054

CVE-2014-2054

This page contains facts from public vulnerability sources. Check the original advisory before updating.

PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.

EPSS 1.5% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • phpoffice/phpexcel Packagist

    Versions
    • 1.7.9
    • 1.7.9-rc1
    • 1.8.0rc1
    • 1.8.0rc2
    • 1.8.0rc3
    • 1.8.0rc4
    Affected ranges
    • ECOSYSTEM: < 1.8.0

    Update to 1.8.0

Original sources

Check your server →