Severity: High

Description: Apache POI in versions prior to release 3.15 allows remote attackers to cause a denial of service (CPU consumption). The remote attack potentially uses a specially crafted OOXML file, also known as an XML Entity Expansion (XEE) attack.

Potential Impact:  There is a total shutdown of the affected resource. The attacker can render the resource completely unavailable.

For additional details see: CVE-2017-5644

Description: Apache POI in versions prior to release 3.17 are vulnerable to the following Denial of Service Attacks:

1. Infinite Loops while parsing crafted WMF, EMF, MSG, and macros (POI bugs 61338 and 61294), and
2. Out of Memory Exceptions while parsing crafted DOC, PPT, and XLS (POI bugs 52372 and 61295).

Potential Impact: There is reduced performance or interruptions in resource availability.

For additional details see: CVE-2017-12626

Click the Hot Fix tab in this note to access the hot fix for this issue.

Operating System and Release Information

A fix for this issue for SAS Risk Governance Framework 7.3 is available at:

A fix for this issue for SAS Model Risk Management 7.3 is available at:

A fix for this issue for SAS Model Risk Management 7.2 is available at:

A fix for this issue for SAS Model Risk Management 7.1 is available at:

A fix for this issue for SAS Model Risk Management 6.1 is available at:

A fix for this issue for SAS Enterprise GRC 6.1 is available at:

A fix for this issue for SAS Enterprise GRC 6.1 is available at:

A fix for this issue for SAS Enterprise GRC 5.1_M5 is available at:

A fix for this issue for SAS Enterprise GRC 5.1_M5 is available at: