Date: Fri, 26 Jan 2018 19:31:27 +0000 (UTC) From: Tim Allison <tallison@...che.org> To: "announce@...che.org" <announce@...che.org>, Security <security@...che.org>, "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>, "user@....apache.org" <user@....apache.org>, "dev@....apache.org" <dev@....apache.org>, "davidedillard@...il.com" <davidedillard@...il.com> Subject: CVE-2017-12626 – Denial of Service Vulnerabilities in Apache POI < 3.17 Title: CVE-2017-12626 – Denial of Service Vulnerabilities in Apache POI < 3.17 Severity: Important Vendor: The Apache Software Foundation Versions affected: versions prior to version 3.17 Description: Apache POI versions prior to release 3.17 are vulnerable to Denial of Service Attacks: * Infinite Loops while parsing specially crafted WMF, EMF, MSG and macros (POI bugs 61338  and 61294 ) * Out of Memory Exceptions while parsing specially crafted DOC, PPT and XLS (POI bugs 52372  and 61295 ) Mitigation: Users with applications which accept content from external or untrusted sources are advised to upgrade to Apache POI 3.17 or newer. -Tim Allison on behalf of the Apache POI PMC  https://bz.apache.org/bugzilla/show_bug.cgi?id=61338  https://bz.apache.org/bugzilla/show_bug.cgi?id=61294  https://bz.apache.org/bugzilla/show_bug.cgi?id=52372  https://bz.apache.org/bugzilla/show_bug.cgi?id=61295
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.