CVE-2017-12626
The MITRE CVE dictionary describes this issue as:
Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).
Find out more about CVE-2017-12626 from the MITRE CVE dictionary dictionary and NIST NVD.
CVSS v3 metrics
| CVSS3 Base Score | 5.3 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity Impact | None |
| Availability Impact | Low |
Red Hat Security Errata
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat JBoss Fuse 6.3 | RHSA-2018:1322 | 2018-05-03 |
| Red Hat JBoss A-MQ 6.3 | RHSA-2018:1322 | 2018-05-03 |
Affected Packages State
| Platform | Package | State |
|---|---|---|
| Red Hat JBoss Portal Platform 6 | poi | Will not fix |
| Red Hat JBoss Fuse Service Works 6 | poi | Will not fix |
| Red Hat JBoss Data Virtualization 6 | poi | Will not fix |
| Red Hat JBoss BRMS 6 | poi | Affected |
| Red Hat JBoss BRMS 5 | poi | Not affected |
| Red Hat JBoss BPMS 6 | poi | Affected |
CVE description copyright © 2017, The MITRE Corporation