CVE-2017-12626

poi: Parsing of multiple file types can cause a denial of service via infinite loop or out of memory exception

Severity Score

7.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Apache POI in versions prior to release 3.17 are vulnerable to Denial of Service Attacks: 1) Infinite Loops while parsing crafted WMF, EMF, MSG and macros (POI bugs 61338 and 61294), and 2) Out of Memory Exceptions while parsing crafted DOC, PPT and XLS (POI bugs 52372 and 61295).

Apache POI, en versiones anteriores al release 3.17, es vulnerable a ataques de denegación de servicio (DoS): 1) bucles infinitos al analizar WMF, EMF, MSG y macros manipuladas (POI bugs 61338 y 61294); y 2) excepciones fuera de memoria al analizar DOC, PPT y XLS manipulados(POI bugs 52372 y 61295).

Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications. This patch is an update to Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ 6.3. It includes bug fixes and enhancements, which are documented in the readme.txt file included with the patch files. Issues addressed include a denial of service vulnerability.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-08-07 CVE Reserved
2018-01-29 CVE Published
2024-09-16 CVE Updated
2025-04-06 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

CAPEC

References (13)

URL	Tag	Source
http://www.securityfocus.com/bid/102879	Third Party Advisory
https://lists.apache.org/thread.html/453d9af5dbabaccd9afb58d27279a9dbfe8e35f4e5ea1645ddd6960b%40%3Cdev.poi.apache.org%3E	Mailing List
https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E	Mailing List
https://www.oracle.com/security-alerts/cpuApr2021.html	X_refsource_misc
https://www.oracle.com/security-alerts/cpuapr2020.html	X_refsource_misc
https://www.oracle.com/security-alerts/cpujan2020.html	X_refsource_misc
https://www.oracle.com/security-alerts/cpujan2021.html	X_refsource_misc
https://www.oracle.com/security-alerts/cpujul2020.html	X_refsource_misc
https://www.oracle.com/security-alerts/cpuoct2020.html	X_refsource_misc
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html	X_refsource_misc

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://access.redhat.com/errata/RHSA-2018:1322	2023-11-07
https://access.redhat.com/security/cve/CVE-2017-12626	2018-05-03
https://bugzilla.redhat.com/show_bug.cgi?id=1539989	2018-05-03

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Apache Search vendor "Apache"		Poi Search vendor "Apache" for product "Poi"				< 3.17 Search vendor "Apache" for product "Poi" and version " < 3.17"		-		Affected