First published: Sun Dec 24 2023(Updated: )
Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.
Credit: mandiant-cve@google.com mandiant-cve@google.com
Affected Software | Affected Version | How to fix |
---|---|---|
Google Chrome | =120.0.6099.129/130 | |
Spreadsheet::ParseExcel Spreadsheet::ParseExcel | =0.65 | |
debian/libspreadsheet-parseexcel-perl | <=0.6500-1 | 0.6500-1+deb10u1 0.6500-1.1+deb11u1 0.6500-4~deb12u1 0.6600-1 |
ubuntu/libspreadsheet-parseexcel-perl | <0.6500-1ubuntu0.18.04.1~ | 0.6500-1ubuntu0.18.04.1~ |
ubuntu/libspreadsheet-parseexcel-perl | <0.6500-1ubuntu0.20.04.1 | 0.6500-1ubuntu0.20.04.1 |
ubuntu/libspreadsheet-parseexcel-perl | <0.6500-1.1ubuntu0.1 | 0.6500-1.1ubuntu0.1 |
ubuntu/libspreadsheet-parseexcel-perl | <0.5800-1ubuntu0.1~ | 0.5800-1ubuntu0.1~ |
ubuntu/libspreadsheet-parseexcel-perl | <0.6500-4 | 0.6500-4 |
ubuntu/libspreadsheet-parseexcel-perl | <0.6500-1ubuntu0.16.04.1~ | 0.6500-1ubuntu0.16.04.1~ |
Jmcnamara Spreadsheet\ | <=0.65 | |
Debian Debian Linux | =10.0 | |
Fedoraproject Fedora | =38 | |
Fedoraproject Fedora | =39 | |
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc
Update to version 0.66
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.