www-announce mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Uwe Schindler" <uschind...@apache.org>
Subject [ANNOUNCE] Apache POI 3.11-beta2 released
Date Thu, 21 Aug 2014 20:58:26 GMT
The Apache POI project is pleased to announce the release of POI 3.11-beta2. 
Featured are a handful of new areas of functionality, and numerous bug fixes.

See the downloads page for binary and source distributions: http://poi.apache.org/download.html

Note: The Apache Software Foundation uses an extensive mirroring network for distributing
releases. It is possible that the mirror you are using may not have replicated the release
yet. If that is the case, please try another mirror. This also goes for Maven access.

Release Notes 

This release fixes two security issues with OOXML:

 - Tidy up the OPC SAX setup code with a new common Helper, preventing
   external entity expansion (CVE-2014-3529).
 - On supported XML parser versions (Xerces or JVM built-in, XMLBeans 2.6),
   enforce sensible limits on entity expansion in OOXML files, and ensure
   that subsequent normal files still pass fine (CVE-2014-3574).

Please note: You should use xmlbeans-2.6.jar (as shipped with this release)
instead of the xmlbeans-2.3.jar version from the 3.10-FINAL release to work
around CVE-2014-3574. If you have an alternate XML parser like Apache Xerces
in classpath, be sure to use a recent version! Older versions are likely to
break on setting required security features.

Thanks to Stefan Kopf, Mike Boufford, Mohamed Ramadan, and Christian Schneider
for reporting these issues!

Other notable changes in this release are:

 - Switch from dom4j to JAXP: dom4j is no longer a dependency of Apache POI,
   it solely uses xmlbeans-2.6.jar and the DOM implementation as shipped by the JDK.
 - For XSLF Pictures, provide a way to get the URI of externally linked pictures
 - Provide a helpful exception, XLSBUnsupportedException, if XSSFWorkbook is passed a .xlsb

A full list of changes is available in the change log: http://poi.apache.org/changes.html.

People interested should also follow the dev mailing list to track further progress.

Release Contents

This release comes in two forms:
 - pre-built binaries containing compiled versions of all Apache POI components and documentation

   (poi-bin-3.11-beta2-20140822.zip or poi-bin-3.11-beta2-20140822.tar.gz)
 - source archive you can build POI from (poi-src-3.11-beta2-20140822.zip or poi-src-3.11-beta2-20140822.tar.gz)
  Unpack the archive and use  the following command to build all POI components with Apache
Ant 1.6+ and JDK 1.6 or higher:

  ant jar

 Pre-built versions of all POI components are also available in the central Maven repository

 under Group ID "org.apache.poi" and Version "3.11-beta2"

All release artifacts are accompanied by MD5 checksums and a PGP signatures 
that you can use to verify the authenticity of your download.
The public key used for the PGP signature can be found at 

About Apache POI

Apache POI is well-known in the Java field as a library for reading and
writing Microsoft Office file formats, such as Excel, PowerPoint, Word,
Visio, Publisher and Outlook. It supports both the older (OLE2) and
new (OOXML - Office Open XML) formats.

See http://poi.apache.org/ for more details

On behalf of the Apache POI PMC,

Uwe Schindler
Apache Lucene PMC Member / Committer
Bremen, Germany

View raw message