Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Debian 10 Buster: DLA-3723-1 critical: libspreadsheet-parsexlsx-perl DoS

debian lts
Calendar Grey January 27, 2024
Dist Debian Esm H88
The latest release of libspreadsheet-parsexlsx-perl has been launched, addressing critical security flaws that posed a threat of denial-of-service attacks.
Security vulnerabilities were found in libspreadsheet-parsexlsx-perl, a Perl module to parse XLSX files, which could lead to denial of service or server-side request forgery via cr...
Topics%20covered

Topics Covered

security advisory denial of service debian perl module server-side request forgery libspreadsheet-parsexlsx

Summary

CVE-2024-22368

Le Dinh Hai discovered that the memoize implementation allows
attacker to allocate an arbitrary memory size, which could lead to
denial of service via memory exhaustion.

CVE-2024-23525

An Pham discovered an XML external entity (XXE) vulnerability via
crafted input, which could lead to denial of service or server-side
request forgery.

For Debian 10 buster, these problems have been fixed in version
0.27-2+deb10u1.

We recommend that you upgrade your libspreadsheet-parsexlsx-perl packages.

For the detailed security status of libspreadsheet-parsexlsx-perl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/libspreadsheet-parsexlsx-perl

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Severity
critical
Lowest
Low
Medium
High
Critical

Package: libspreadsheet-parsexlsx-perl
Version: 0.27-2+deb10u1
CVE ID: CVE-2024-22368 CVE-2024-23525
Debian Bug: 1061098

Topics%20covered

Topics Covered

security advisory denial of service debian perl module server-side request forgery libspreadsheet-parsexlsx

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here