Summary
Le Dinh Hai discovered that Spreadsheet::ParseExcel was passing unvalidated
input from a file into a string-type "eval". An attacker could craft a
malicious file to achieve arbitrary code execution.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | libspreadsheet-parseexcel-perl | 0.6500-1ubuntu0.20.04.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | libspreadsheet-parseexcel-perl | 0.6500-1.1ubuntu0.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | libspreadsheet-parseexcel-perl | 0.5800-1ubuntu0.1~esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libspreadsheet-parseexcel-perl | 0.6500-1ubuntu0.16.04.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libspreadsheet-parseexcel-perl | 0.6500-1ubuntu0.18.04.1~esm1 |
Vulnerabilities 1
-
High 7.8
Arbitrary Code Execution (ACE) Vulnerability
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, …
KEV Jan 2, 2024
References
-
report
https://ubuntu.com/security/CVE-2023-7101