Gentoo Archives: gentoo-announce

From: Thomas Deutschmann <whissi@g.o>
To: gentoo-announce@l.g.o
Subject: [gentoo-announce] [ GLSA 202003-64 ] libxls: Multiple vulnerabilities
Date: Mon, 30 Mar 2020 14:55:06
Message-Id: 79bb9002-f326-ddfc-b0dd-45368f5f2f43@gentoo.org
1 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
2 Gentoo Linux Security Advisory GLSA 202003-64
3 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
4 https://security.gentoo.org/
5 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
6
7 Severity: Normal
8 Title: libxls: Multiple vulnerabilities
9 Date: March 30, 2020
10 Bugs: #638336, #674006
11 ID: 202003-64
12
13 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
14
15 Synopsis
16 ========
17
18 Multiple vulnerabilities have been found in libxls, the worst of which
19 could result in the arbitrary execution of code.
20
21 Background
22 ==========
23
24 libxls is a C library for reading Excel files in the nasty old binary
25 OLE format, plus a command-line tool for converting XLS to CSV.
26
27 Affected packages
28 =================
29
30 -------------------------------------------------------------------
31 Package / Vulnerable / Unaffected
32 -------------------------------------------------------------------
33 1 dev-libs/libxls < 1.5.2 >= 1.5.2
34
35 Description
36 ===========
37
38 Multiple vulnerabilities have been discovered in libxls. Please review
39 the CVE identifiers referenced below for details.
40
41 Impact
42 ======
43
44 A remote attacker could entice a user to process a specially crafted
45 Excel file using libxls, possibly resulting in execution of arbitrary
46 code with the privileges of the process or a Denial of Service
47 condition.
48
49 Workaround
50 ==========
51
52 There is no known workaround at this time.
53
54 Resolution
55 ==========
56
57 All libxls users should upgrade to the latest version:
58
59 # emerge --sync
60 # emerge --ask --oneshot --verbose ">=dev-libs/libxls-1.5.2"
61
62 References
63 ==========
64
65 [ 1 ] CVE-2017-12110
66 https://nvd.nist.gov/vuln/detail/CVE-2017-12110
67 [ 2 ] CVE-2017-12111
68 https://nvd.nist.gov/vuln/detail/CVE-2017-12111
69 [ 3 ] CVE-2017-2896
70 https://nvd.nist.gov/vuln/detail/CVE-2017-2896
71 [ 4 ] CVE-2017-2897
72 https://nvd.nist.gov/vuln/detail/CVE-2017-2897
73 [ 5 ] CVE-2017-2919
74 https://nvd.nist.gov/vuln/detail/CVE-2017-2919
75 [ 6 ] CVE-2018-20450
76 https://nvd.nist.gov/vuln/detail/CVE-2018-20450
77 [ 7 ] CVE-2018-20452
78 https://nvd.nist.gov/vuln/detail/CVE-2018-20452
79
80 Availability
81 ============
82
83 This GLSA and any updates to it are available for viewing at
84 the Gentoo Security Website:
85
86 https://security.gentoo.org/glsa/202003-64
87
88 Concerns?
89 =========
90
91 Security is a primary focus of Gentoo Linux and ensuring the
92 confidentiality and security of our users' machines is of utmost
93 importance to us. Any security concerns should be addressed to
94 security@g.o or alternatively, you may file a bug at
95 https://bugs.gentoo.org.
96
97 License
98 =======
99
100 Copyright 2020 Gentoo Foundation, Inc; referenced text
101 belongs to its owner(s).
102
103 The contents of this document are licensed under the
104 Creative Commons - Attribution / Share Alike license.
105
106 https://creativecommons.org/licenses/by-sa/2.5

Attachments

File name MIME type
signature.asc application/pgp-signature