PT-2018-15292 · Libexcel · Libexcel

Fantasyoung · Published 2018-12-18 · Updated 2019-01-10 · CVE-2018-20213

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libexcel version 0.01

Description The issue allows attackers to cause a denial of service (SEGV) via a long name in the wbook addworksheet function in workbook.c in libexcel.a.

Recommendations For libexcel version 0.01, avoid using long names in the wbook addworksheet function to prevent the denial of service.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2018-20213

Affected Products

Libexcel

References · 3

• 🔥 https://github.com/devinsmith/libexcel/issues/8 · Exploit
• https://osv.dev/vulnerability/CVE-2018-20213 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20213 · Security Note