PT-2018-3602 · Apache · Apache Poi

Publicado

2018-01-29

·

Atualizado

2021-06-14

·

CVE-2017-12626

CVSS v2.0

7.8

Alta

VetorAV:N/AC:L/Au:N/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions Apache POI versions prior to 3.17
Description The issue is related to Denial of Service Attacks. It involves two main problems:
  1. Infinite Loops while parsing crafted WMF, EMF, MSG, and macros,
  2. Out of Memory Exceptions while parsing crafted DOC, PPT, and XLS. This can be exploited by a remote attacker to cause a denial of service.
Recommendations For versions prior to 3.17, update to release 3.17 or later to resolve the issue. As a temporary workaround, consider restricting the parsing of crafted files to minimize the risk of exploitation. Avoid using the vulnerable functions related to parsing WMF, EMF, MSG, macros, DOC, PPT, and XLS until the issue is resolved.

Correção

Infinite Loop

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-835

Identificadores relacionados

BDU:2021-00682
CVE-2017-12626
GHSA-523C-XH4G-MH5M

Produtos afetados

Apache Poi