CVE-2018-7438: High severity Freexl Project Freexl vulnerability
Published Feb 23, 2018
·Updated
An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the parseunicodestring function.
Affected Software
5 affected componentsFixes available
debian/freexl
1.0.5-31.0.6-11.0.6-22.0.0-1
Freexl Project Freexl<1.0.5
Debian Debian Linux=7.0
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freexlto a version that resolves this vulnerability.Fixed in 1.0.5-3Fixed in 1.0.6-1Fixed in 1.0.6-2Fixed in 2.0.0-1
Event History
Feb 23, 2018
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Data Sourced
via NVD·09:29 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2018-7438?
CVE-2018-7438 has been classified as having moderate severity due to its potential for heap-based buffer over-read.
2
How do I fix CVE-2018-7438?
To resolve CVE-2018-7438, upgrade FreeXL to version 1.0.5 or later.
3
Which versions of FreeXL are affected by CVE-2018-7438?
FreeXL versions before 1.0.5 are affected by CVE-2018-7438.
4
Is CVE-2018-7438 present in Debian 8.0 or 9.0?
Yes, Debian 8.0 and 9.0 include vulnerable versions of FreeXL that are affected by CVE-2018-7438.
5
What is the cause of CVE-2018-7438?
CVE-2018-7438 is caused by a heap-based buffer over-read in the parse_unicode_string function of FreeXL.