CVE-2017-12111: High severity libxls vulnerability

Published Nov 20, 2017

Updated

An exploitable out-of-bounds vulnerability exists in the xlsaddCell function of libxls 1.4. A specially crafted XLS file with a formula record can cause memory corruption resulting in remote code execution. An attacker can send a malicious XLS file to trigger this vulnerability.

Affected Software

2 affected componentsFixes available

debian/r-cran-readxl

1.3.0-11.3.1-21.4.2-11.4.3-1

Libxls Project Libxls=1.4

Event History

Nov 20, 2017

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is CVE-2017-12111?

CVE-2017-12111 is an exploitable out-of-bounds vulnerability in the xls_addCell function of libxls 1.4.

What is the severity of CVE-2017-12111?

The severity of CVE-2017-12111 is high, with a CVSS score of 7.8.

How does CVE-2017-12111 work?

CVE-2017-12111 can be triggered by sending a specially crafted XLS file with a formula record, which can cause memory corruption and lead to remote code execution.

Which software versions are affected by CVE-2017-12111?

The affected software versions are libxls 1.4, r-cran-readxl 1.3.0-1, r-cran-readxl 1.3.1-2, r-cran-readxl 1.4.2-1, and r-cran-readxl 1.4.3-1.

How can I fix CVE-2017-12111?

To fix CVE-2017-12111, update to a non-vulnerable version of the affected software packages, such as r-cran-readxl 1.4.4 or higher.