Description
msxlsview.sh in xlsview for catdoc 0.91 and earlier allows local users to overwrite arbitrary files via a symlink attack on predictable temporary file names ("word$$.html").
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | catdoc | 0.91.5-2 | — |
| Debian 13 | catdoc | 0.91.5-2 | — |
| Debian 12 | catdoc | 0.91.5-2 | — |
| Debian 3.0 | catdoc | 0.91.5-1.woody3 | DSA-575-1 |
Advisories 1
- DSA-575-1 catdoc - insecure temporary file Debian Security (DSA / DLA) · Mar 9, 2026
References
- 11193 vdb-entry
- 11560 vdb-entry
- 13021 third-party-advisory
- 13022 third-party-advisory
- catdoc-xlsview-symlink(16335) vdb-entry
- http://bugs.debian.org/cgi-bin/bugreport.cgi?archive=no&bug=183525
- DSA-575 vendor-advisory