CVE-2023-38851

2023-08-1517:15:10

Google

osv.dev

cve-2023-38851

remote attacker

arbitrary code

denial of service

crafted xls file

xls_parseworkbook function

xls.c:1018

software

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

8.2 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

34.5%

JSON

Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the xls_parseWorkBook function in xls.c:1018.

CPENameOperatorVersion
r-cran-readxleq1.4.3-1
libxlseq1.6.2
libxlseq1.1.0
r-cran-readxleq1.4.2-1
libxlseq0.3.0
libxlseq1.3.0
libxlseq1.5.0-rc1
r-cran-readxleq1.3.1-1
libxlseq1.3.4
libxlseq1.5.0-rc3

Name	Operator	Version
r-cran-readxl	eq	1.4.3-1
libxls	eq	1.6.2
libxls	eq	1.1.0
r-cran-readxl	eq	1.4.2-1
libxls	eq	0.3.0
libxls	eq	1.3.0
libxls	eq	1.5.0-rc1
r-cran-readxl	eq	1.3.1-1
libxls	eq	1.3.4
libxls	eq	1.5.0-rc3