Integer Overflow in freexl Library
Summary
DSA-3310-1: freexl - security update. Affects freexl versions < 1.0.0b-1+deb7u2. Fixed in 1.0.0b-1+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The freexl library is used to parse Microsoft Excel spreadsheets. It provides functionality to read and extract data from Excel files. The library is commonly used in various applications that need to handle Excel files. However, a vulnerability has been discovered in freexl that can lead to a denial of service if a malformed Excel file is opened.
Vulnerability Detail
The vulnerability in freexl is caused by an integer overflow. When parsing a malformed Excel file, an attacker can craft a file that triggers the overflow, leading to a denial of service. This can cause the application using freexl to crash or become unresponsive. The impact of this vulnerability is limited to the application using the freexl library and does not allow for remote code execution or privilege escalation.
How To Fix
Minimum fixed version
1.0.0b-1+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade freexlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
An integer overflow vulnerability has been discovered in the freexl library, which can result in a denial of service if a malformed Excel file is opened. To mitigate this vulnerability, users should upgrade their freexl packages to the fixed versions provided for their respective distributions. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for freexl →
FAQ
Freexl is a library used to parse Microsoft Excel spreadsheets. It provides functionality to read and extract data from Excel files.
The vulnerability can lead to a denial of service if a malformed Excel file is opened. This can cause the application using freexl to crash or become unresponsive.
No, this vulnerability does not allow for remote code execution or privilege escalation. The impact is limited to the application using the freexl library.
To fix this vulnerability, you should upgrade the freexl package to the fixed version provided for your distribution.
No, there is no known workaround for this vulnerability. It is recommended to upgrade the freexl package to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for freexl.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
