Vulnerability in freexl package - Heap-based Buffer Overflow
Summary
DLA-1098-1: freexl - security update. Affects freexl versions < 1.0.0b-1+deb7u4. Fixed in 1.0.0b-1+deb7u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The freexl package is a library that provides access to the contents of Microsoft Excel files. It allows users to read and extract data from XLS files. The package is commonly used in various applications that require Excel file processing. However, versions up to and including 1.0.3 of freexl are vulnerable to two heap-based buffer overflow vulnerabilities.
Vulnerability Detail
The first vulnerability, identified as CVE-2017-2923, exists in the read_biff_next_record function of FreeXL 1.0.3. An attacker can exploit this vulnerability by sending a specially crafted XLS file, triggering a heap-based buffer overflow. This can lead to memory corruption and potentially enable remote code execution.
The second vulnerability, known as CVE-2017-2924, is present in the read_legacy_biff function of FreeXL 1.0.3. By sending a malicious XLS file, an attacker can exploit this vulnerability to trigger a heap-based buffer overflow, resulting in memory corruption and potential remote code execution.
How To Fix
Minimum fixed version
1.0.0b-1+deb7u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade freexlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The freexl package, versions up to and including 1.0.3, is vulnerable to heap-based buffer overflow vulnerabilities. These vulnerabilities can be exploited by sending specially crafted XLS files, potentially leading to memory corruption and remote code execution. It is crucial to upgrade to version 1.0.0b-1+deb7u4 or later to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for freexl →
FAQ
Freexl is a library that provides access to Microsoft Excel files, allowing users to read and extract data from XLS files.
Versions up to and including 1.0.3 of freexl are vulnerable to the heap-based buffer overflow vulnerabilities (CVE-2017-2923 and CVE-2017-2924).
An attacker can exploit these vulnerabilities by sending a specially crafted XLS file, triggering a heap-based buffer overflow and potentially enabling remote code execution.
The vulnerabilities can lead to memory corruption and remote code execution, potentially allowing an attacker to take control of the affected system.
To fix these vulnerabilities, it is recommended to upgrade the freexl package to version 1.0.0b-1+deb7u4 or later.
Related vulnerabilities
Recent vulnerabilities recorded for freexl.
