Summary
Le Dinh Hai discovered that Spreadsheet::ParseXLSX did not properly manage
memory during cell merge operations. An attacker could possibly use this
issue to consume large amounts of memory, resulting in a denial of service
condition. (CVE-2024-22368)
An Pham discovered that Spreadsheet::ParseXLSX allowed the processing of
external entities in a default configuration. An attacker could possibly
use this vulnerability to execute an XML External Entity (XXE) injection
attack. (CVE-2024-23525)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | libspreadsheet-parsexlsx-perl | 0.27-2+deb10u1build0.20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | libspreadsheet-parsexlsx-perl | 0.27-2.1+deb11u2build0.22.04.1 |
Vulnerabilities 2
-
Medium 6.5
The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the no_xxe option…
-
Medium 5.5
The Spreadsheet::ParseXLSX package before 0.28 for Perl can encounter an out-of-memory condition during parsing of a cr…