Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6781-1 advisory.

    Le Dinh Hai discovered that Spreadsheet::ParseExcel was passing unvalidated

    input from a file into a string-type eval. An attacker could craft a

    malicious file to achieve arbitrary code execution.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Spreadsheet::ParseExcel perl module is vulnerable to a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic. 

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the cb22a9a6-c907-11ee-8d1c-40b034429ecf advisory.

  - Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files.
    Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing     unvalidated input from a file into a string-type eval. Specifically, the issue stems from the evaluation     of Number format strings (not to be confused with printf-style format strings) within the Excel parsing     logic. (CVE-2023-7101)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of perl-Spreadsheet-ParseExcel installed on the remote host is prior to 0.5900-5.3. It is, therefore, affected by a vulnerability as referenced in the ALAS-2024-1905 advisory.

  - Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files.
    Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing     unvalidated input from a file into a string-type eval. Specifically, the issue stems from the evaluation     of Number format strings (not to be confused with printf-style format strings) within the Excel parsing     logic. (CVE-2023-7101)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-491 advisory.

  - Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files.
    Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing     unvalidated input from a file into a string-type eval. Specifically, the issue stems from the evaluation     of Number format strings (not to be confused with printf-style format strings) within the Excel parsing     logic. (CVE-2023-7101)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:0158-1 advisory.

  - Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files.
    Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing     unvalidated input from a file into a string-type eval. Specifically, the issue stems from the evaluation     of Number format strings (not to be confused with printf-style format strings) within the Excel parsing     logic. (CVE-2023-7101)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-921f6975c2 advisory.

    Fix for CVE-2023-7101 (unvalidated input can lead to arbitrary code execution vulnerability).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-84d3cc47b1 advisory.

    Fix for CVE-2023-7101 (unvalidated input can lead to arbitrary code execution vulnerability).

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
197570	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS : Spreadsheet::ParseExcel vulnerability (USN-6781-1)	Nessus	Ubuntu Local Security Checks	high
197297	Spreadsheet::ParseExcel RCE (CVE-2023-7101)	Nessus	Misc.	high
190420	FreeBSD : p5-Spreadsheet-ParseExcel -- Remote Code Execution Vulnerability (cb22a9a6-c907-11ee-8d1c-40b034429ecf)	Nessus	FreeBSD Local Security Checks	high
189394	Amazon Linux AMI : perl-Spreadsheet-ParseExcel (ALAS-2024-1905)	Nessus	Amazon Linux Local Security Checks	high
189338	Amazon Linux 2023 : perl-Spreadsheet-ParseExcel (ALAS2023-2024-491)	Nessus	Amazon Linux Local Security Checks	high
189205	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : perl-Spreadsheet-ParseExcel (SUSE-SU-2024:0158-1)	Nessus	SuSE Local Security Checks	high
187671	Fedora 39 : perl-Spreadsheet-ParseExcel (2023-921f6975c2)	Nessus	Fedora Local Security Checks	high
187669	Fedora 38 : perl-Spreadsheet-ParseExcel (2023-84d3cc47b1)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2023-7101

high

Tenable Plugins

high

high

high

high

high

high

high

high