PT-2017-15604 · Libxls · Libxls

Published 2017-11-20 · Updated 2023-07-13 · CVE-2017-2896

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libxls versions 1.3.4 through 1.4.0

Description An out-of-bounds write vulnerability exists in the xls mergedCells function of libxls, allowing a specially crafted XLS file to cause memory corruption, potentially resulting in remote code execution. Additionally, memory management issues, including double-free and invalid free flaws, have been discovered in the read MSAT and read MSAT body functions within the ole.c component of libxls. These issues can be exploited by an attacker using a crafted file to cause a Denial of Service (DoS) or application crash. Other vulnerabilities, including stack-based buffer overflow and integer overflow, have been identified in various functions of libxls, such as xls getfcell, xls preparseWorkSheet, and xls appendSST, which can also lead to memory corruption and potentially result in remote code execution.

Recommendations For libxls versions 1.3.4 through 1.4.0, consider disabling the xls mergedCells function and restricting the use of the read MSAT and read MSAT body functions until a patch is available. Avoid using the xls getfcell, xls preparseWorkSheet, and xls appendSST functions with crafted XLS files. As a temporary workaround, restrict access to the ole.c component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2017-2896

DSA-4173-1

RSEC-2023-0

RSEC-2023-1

Affected Products

Libxls

References · 35

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2919 · Security Note
• https://osv.dev/vulnerability/DSA-4173-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-2896 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-2896 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-2896 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12110 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12108 · Security Note
• https://osv.dev/vulnerability/CVE-2017-2896 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12111 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-2896 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-2896 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-4173-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-2896 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2897 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12109 · Security Note