Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-7101: Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type "eval". Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | perl-Spreadsheet-ParseExcel | 0:0.6500-28.amzn2023.0.3 |
Vulnerabilities 1
-
High 7.8
Arbitrary Code Execution (ACE) Vulnerability
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, …
KEV Jan 2, 2024
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2023-7101.html