PT-2020-8472 · Libxls · Libxls

Published 2020-12-02 · Updated 2020-12-04 · CVE-2017-2910

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: libxls version 2.0

Description: An exploitable Out-of-bounds Write issue exists in the xls addCell function. A specially crafted xls file can cause memory corruption, resulting in remote code execution. An attacker can send a malicious xls file to trigger this issue.

Recommendations: For libxls version 2.0, consider disabling the xls addCell function until a patch is available to prevent potential exploitation. Restrict access to handling xls files to minimize the risk of remote code execution. Avoid using libxls version 2.0 to process untrusted xls files until the issue is resolved.

Exploit

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2017-2910

Affected Products

Libxls

References · 8

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2017-0417 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-2910 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-2910 · Security Note
• https://ubuntu.com/security/CVE-2017-2910 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-2910 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-2910 · Vendor Advisory
• https://t.me/cibsecurity/17051 · Telegram Post
• https://t.me/cvenotify/6610 · Telegram Post