Vulnerability in Apache Poi
CVE-2017-12626
Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).
EPSS: 0.101 (95.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Apache Poi
- Apache Software Foundation Poi — versions < 3.17
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- security@apache.org (mailing-list, x_refsource_MLIST)
- security@apache.org (x_refsource_MISC)
- security@apache.org (x_refsource_MISC)
- security@apache.org (x_refsource_MISC)
- security@apache.org (x_refsource_MISC)
- security@apache.org (x_refsource_MISC)
- security@apache.org (x_refsource_MISC)
Frequently asked questions
- What is CVE-2017-12626?
- CVE-2017-12626 is a high-severity vulnerability in Apache Poi, classified under Loop with Unreachable Exit Condition (Infinite Loop). CVSS score: 7.5/10. Published 2018-01-29.
- How severe is CVE-2017-12626?
- High severity. CVSS v3 base score is 7.5 out of 10.
- Is CVE-2017-12626 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.