xlsxio v0.1.2 to v0.2.34 was discovered to contain a free of uninitialized pointer in the xlsxioread_sheetlist_close() function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted XLSX file.
References
| Link | Resource |
|---|---|
| https://github.com/brechtsanders/xlsxio/commit/d653f1604b54532f11b45dca1fa164b4a1f15e2d | Patch |
| https://github.com/xf1les/cve-advisories/blob/main/2023/CVE-2023-34795.md | Exploit Third Party Advisory |
| https://github.com/brechtsanders/xlsxio/issues/121 | Exploit Issue Tracking Third Party Advisory |
Configurations
History
27 Jun 2023, 01:54
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:xlsxio_project:xlsxio:*:*:*:*:*:*:*:* | |
| First Time |
Xlsxio Project
Xlsxio Project xlsxio |
|
| CWE | CWE-416 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
| References | (MISC) https://github.com/brechtsanders/xlsxio/issues/121 - Exploit, Issue Tracking, Third Party Advisory | |
| References | (MISC) https://github.com/brechtsanders/xlsxio/commit/d653f1604b54532f11b45dca1fa164b4a1f15e2d - Patch | |
| References | (MISC) https://github.com/xf1les/cve-advisories/blob/main/2023/CVE-2023-34795.md - Exploit, Third Party Advisory |
16 Jun 2023, 16:41
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-16 16:15
Updated : 2023-06-27 01:54
NVD link : CVE-2023-34795
Mitre link : CVE-2023-34795
JSON object : View
Products Affected
xlsxio_project
- xlsxio
CWE
CWE-416
Use After Free