CVE-2017-12109: Integer Overflow

Published Apr 24, 2018

Updated

An exploitable integer overflow vulnerability exists in the xlspreparseWorkSheet function of libxls 1.4 when handling a MULRK record. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.

Affected Software

1 affected component

Libxls Project Libxls=1.4

Event History

Apr 24, 2018

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2017-12109?

CVE-2017-12109 is an integer overflow vulnerability in the xls_preparseWorkSheet function of libxls 1.4.

What is the impact of CVE-2017-12109?

This vulnerability allows remote code execution by exploiting a memory corruption issue in libxls.

How can an attacker exploit CVE-2017-12109?

An attacker can exploit CVE-2017-12109 by sending a specially crafted XLS file to trigger the vulnerability.

Is there a known fix for CVE-2017-12109?

At the moment, there is no known fix for CVE-2017-12109.

Where can I find more information about CVE-2017-12109?

You can find more information about CVE-2017-12109 at https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0461.