xlsxio up to 0.2.34 XLSX File xlsxioread_sheetlist_close uninitialized pointer

Summaryinfo

A vulnerability was found in xlsxio up to 0.2.34. It has been rated as problematic. This issue affects the function xlsxioread_sheetlist_close of the component XLSX File Handler. This manipulation causes uninitialized pointer. This vulnerability appears as CVE-2023-34795. There is no available exploit. To fix this issue, it is recommended to deploy a patch.

Detailsinfo

A vulnerability has been found in xlsxio up to 0.2.34 and classified as problematic. Affected by this vulnerability is the function xlsxioread_sheetlist_close of the component XLSX File Handler. The manipulation with an unknown input leads to a uninitialized pointer vulnerability. The CWE definition for the vulnerability is CWE-824. The product accesses or uses a pointer that has not been initialized. As an impact it is known to affect availability. The summary by CVE is:

xlsxio v0.1.2 to v0.2.34 was discovered to contain a free of uninitialized pointer in the xlsxioread_sheetlist_close() function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted XLSX file.

The weakness was presented 06/17/2023 as 121. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2023-34795 since 06/07/2023. Technical details of the vulnerability are known, but there is no available exploit.

Applying the patch d653f1604b54532f11b45dca1fa164b4a1f15e2d is able to eliminate this problem. The bugfix is ready for download at github.com.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Name

• xlsxio

Version

• 0.2.0
• 0.2.1
• 0.2.2
• 0.2.3
• 0.2.4
• 0.2.5
• 0.2.6
• 0.2.7
• 0.2.8
• 0.2.9
• 0.2.10
• 0.2.11
• 0.2.12
• 0.2.13
• 0.2.14
• 0.2.15
• 0.2.16
• 0.2.17
• 0.2.18
• 0.2.19
• 0.2.20
• 0.2.21
• 0.2.22
• 0.2.23
• 0.2.24
• 0.2.25
• 0.2.26
• 0.2.27
• 0.2.28
• 0.2.29
• 0.2.30
• 0.2.31
• 0.2.32
• 0.2.33
• 0.2.34

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion