The Spreadsheet::ParseXLSX package before 0.28 for Perl can encounter an out-of-memory condition during parsing of a crafted XLSX document. This occurs because the memoize implementation does not have appropriate constraints on merged cells.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6769-1 advisory.

    Le Dinh Hai discovered that Spreadsheet::ParseXLSX did not properly manage memory during cell merge     operations. An attacker could possibly use this issue to consume large amounts of memory, resulting in a     denial of service condition. (CVE-2024-22368)

    An Pham discovered that Spreadsheet::ParseXLSX allowed the processing of external entities in a default     configuration. An attacker could possibly use this vulnerability to execute an XML External Entity (XXE)     injection attack. (CVE-2024-23525)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-5f136f5d10 advisory.

    Update to latest version     Security fix for CVE-2024-22368

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-fa14bfd3b5 advisory.

    Update to latest version     Security fix for CVE-2024-22368

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3723 advisory.

  - The Spreadsheet::ParseXLSX package before 0.28 for Perl can encounter an out-of-memory condition during     parsing of a crafted XLSX document. This occurs because the memoize implementation does not have     appropriate constraints on merged cells. (CVE-2024-22368)

  - The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the     no_xxe option of XML::Twig. (CVE-2024-23525)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2024:0021-1 advisory.

  - The Spreadsheet::ParseXLSX package before 0.28 for Perl can encounter an out-of-memory condition during     parsing of a crafted XLSX document. This occurs because the memoize implementation does not have     appropriate constraints on merged cells. (CVE-2024-22368)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
195222	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : Spreadsheet::ParseXLSX vulnerabilities (USN-6769-1)	Nessus	Ubuntu Local Security Checks	medium
191039	Fedora 39 : perl-Spreadsheet-ParseXLSX (2024-5f136f5d10)	Nessus	Fedora Local Security Checks	medium
191037	Fedora 38 : perl-Spreadsheet-ParseXLSX (2024-fa14bfd3b5)	Nessus	Fedora Local Security Checks	medium
189722	Debian dla-3723 : libspreadsheet-parsexlsx-perl - security update	Nessus	Debian Local Security Checks	medium
189104	openSUSE 15 Security Update : perl-Spreadsheet-ParseXLSX (openSUSE-SU-2024:0021-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2024-22368

medium

Tenable Plugins

medium

medium

medium

medium

medium