CVE-2017-12110: Integer Overflow

Published Nov 20, 2017

Updated

An exploitable integer overflow vulnerability exists in the xlsappendSST function of libxls 1.4.A specially crafted XLS file can cause memory corruption resulting in remote code execution.

Affected Software

2 affected componentsFixes available

debian/r-cran-readxl

1.3.0-11.3.1-21.4.2-11.4.3-1

Libxls Project Libxls=1.4

Event History

Nov 20, 2017

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2017-12110?

CVE-2017-12110 is an integer overflow vulnerability in the xls_appendSST function of libxls 1.4.

What is the severity of CVE-2017-12110?

CVE-2017-12110 has a severity value of 7.8, which is considered high.

How does CVE-2017-12110 work?

CVE-2017-12110 can be exploited by a specially crafted XLS file to cause memory corruption and remote code execution.

Which software versions are affected by CVE-2017-12110?

Versions 1.3.0-1, 1.3.1-2, 1.4.2-1, and 1.4.3-1 of r-cran-readxl package in Debian and Libxls Project Libxls version 1.4 are affected by CVE-2017-12110.

How can I fix CVE-2017-12110?

To fix CVE-2017-12110, update to a version of r-cran-readxl package later than 1.4.3-1 or update Libxls Project Libxls to a version higher than 1.4.