CVE-2018-20450: Double Free

Published Dec 25, 2018

Updated

The readMSAT function in ole.c in libxls 1.4.0 has a double free that allows attackers to cause a denial of service (application crash) via a crafted file, a different vulnerability than CVE-2017-2897.

Affected Software

1 affected component

Libxls Project Libxls=1.4.0

Event History

Dec 25, 2018

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is CVE-2018-20450?

CVE-2018-20450 is a vulnerability in libxls 1.4.0 that allows attackers to cause a denial of service (application crash) via a crafted file.

How does CVE-2018-20450 impact Libxls Project Libxls 1.4.0?

CVE-2018-20450 allows attackers to crash the application by exploiting a double free vulnerability in libxls 1.4.0.

What is the severity of CVE-2018-20450?

CVE-2018-20450 has a severity rating of medium (6.5).

How can I fix CVE-2018-20450?

To fix CVE-2018-20450, update libxls to a version that is not affected by the vulnerability.

Are there any references for CVE-2018-20450?

Yes, you can find more information about CVE-2018-20450 at the following references: [1] https://github.com/evanmiller/libxls/issues/34 [2] https://security.gentoo.org/glsa/202003-64