Uncontrolled Resource Consumption

phpoffice/phpspreadsheet is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to the Gnumeric reader calling gzdecode on attacker-supplied compressed .gnumeric files without enforcing a decompressed-size limit, which allows an attacker to upload a specially crafted...

PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

Summary PhpSpreadsheet's Gnumeric reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can expand to data large...

GHSA-2MRG-GJXQ-2GVR PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

Summary PhpSpreadsheet's Gnumeric reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can expand to data large...

The vulnerability of the gzfileGetContents() method in the src/PhpSpreadsheet/Reader/Gnumeric.php script of the PhpSpreadsheet library allows a attacker to cause a service failure.

The vulnerability of the gzfileGetContents method in the src/PhpSpreadsheet/Reader/Gnumeric.php script of the PhpSpreadsheet library is related to incorrect processing of highly compressed input data. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-63654

Name of the Vulnerable Software and Affected Versions PhpSpreadsheet affected versions not specified Description An issue exists in the Gnumeric reader where the gzfileGetContents function in src/PhpSpreadsheet/Reader/Gnumeric.php incorrectly handles highly compressed input data. When a .gnumeric...

EUVD-2009-0322

Malware in sbrugna...

EUVD-2008-0678

Malware in sbrugna...

EUVD-2013-6638

Malware in sbrugna...

EUVD-1999-0700

Malware in sbrugna...

SUSE CVE-2008-0668

The excelreadHLINK function in plugins/excel/ms-excel-read.c in Gnome Office Gnumeric before 1.8.1 allows user-assisted remote attackers to execute arbitrary code via a crafted XLS file containing XLS HLINK opcodes, possibly because of an integer signedness error that leads to an integer overflow...

SUSE CVE-2009-0318

Untrusted search path vulnerability in the GObject Python interpreter wrapper in Gnumeric allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySysSetArgv function CVE-2008-5983...

SUSE CVE-2013-6836

Heap-based buffer overflow in the mseschergetdata function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service crash via a crafted xls file with a crafted length value...

Mageia: Security Advisory (MGASA-2014-0086)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the gnumeric-plugins-extra package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the gnumeric-common package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the Gnumeric package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

Vulnerabilities in the Debian GNU/Linux operating system that allow a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information

The multiple vulnerabilities in the gnumeric-doc package of the Debian GNU/Linux operating system may lead to breaches of the confidentiality, integrity, and accessibility of protected information. These vulnerabilities can be exploited remotely...

openSUSE Security Update : gnumeric (openSUSE-SU-2014:0138-1)

Add gnumeric-CVE-2013-6836.patch: fix Heap-buffer-overflow in mseschergetdata on a fuzzed xls file bnc856254, bgo712772, CVE-2013-6838. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update...

Updated gnome-chemistry-utils, gnumeric and goffice packages fix security vulnerability

Heap-based buffer overflow in the mseschergetdata function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service crash via a crafted xls file with a crafted length value. CVE-2013-6836...

MGASA-2014-0086 Updated gnome-chemistry-utils, gnumeric and goffice packages fix security vulnerability

Heap-based buffer overflow in the mseschergetdata function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service crash via a crafted xls file with a crafted length value. CVE-2013-6836...