Lucene search

K
debianDebianDEBIAN:DLA-3723-1:72E28
HistoryJan 27, 2024 - 8:35 p.m.

[SECURITY] [DLA 3723-1] libspreadsheet-parsexlsx-perl security update

2024-01-2720:35:30
lists.debian.org
4
xlsx files
perl module
cve-2024-22368
xml external entity
denial of service
cve-2024-23525
lts advisory
debian 10 buster
server-side request forgery
memory exhaustion
security update

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.9%


Debian LTS Advisory DLA-3723-1 [email protected]
https://www.debian.org/lts/security/ Guilhem Moulin
January 27, 2024 https://wiki.debian.org/LTS

Package : libspreadsheet-parsexlsx-perl
Version : 0.27-2+deb10u1
CVE ID : CVE-2024-22368 CVE-2024-23525
Debian Bug : 1061098

Security vulnerabilities were found in libspreadsheet-parsexlsx-perl, a
Perl module to parse XLSX files, which could lead to denial of service
or server-side request forgery via crafted input.

CVE-2024-22368

Le Dinh Hai discovered that the memoize implementation allows
attacker to allocate an arbitrary memory size, which could lead to
denial of service via memory exhaustion.

CVE-2024-23525

An Pham discovered an XML external entity (XXE) vulnerability via
crafted input, which could lead to denial of service or server-side
request forgery.

For Debian 10 buster, these problems have been fixed in version
0.27-2+deb10u1.

We recommend that you upgrade your libspreadsheet-parsexlsx-perl packages.

For the detailed security status of libspreadsheet-parsexlsx-perl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libspreadsheet-parsexlsx-perl

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

6.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.9%