CVE-2023-7101

Published: 24/12/2023 Updated: 10/06/2024

CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8

VMScore: 0

Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.

Vulnerable Product	Search on Vulmon	Subscribe to Product
jmcnamara spreadsheet
debian debian linux 10.0
fedoraproject fedora 38
fedoraproject fedora 39

Debian Bug report logs - #1059450 libspreadsheet-parseexcel-perl: CVE-2023-7101 Package: src:libspreadsheet-parseexcel-perl; Maintainer for src:libspreadsheet-parseexcel-perl is Debian Perl Group <pkg-perl-maintainers@listsaliothdebianorg>; Affects: libspreadsheet-parsexlsx-perl Reported by: Salvatore Bonaccorso <carnil@ ...

Spreadsheet::ParseExcel version 065 is a Perl module used for parsing Excel files Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type "eval" Specifically, the issue stems from the evaluation of Number format strings (not to be confused with print ...

Hi, The CPAN Security WG was recently informed that the Perl module Spreadsheet::ParseExcel 065 (and earlier) is vulnerable to arbitrary code execution Users should upgrade to version 066 as soon as possible Updated Version: metacpanorg/release/JMCNAMARA/Spreadsheet-ParseExcel-066 Patch: githubcom/jmcnamara/spreadsheet-p ...

Vulnerability of Critical Zero-Day in Barracuda Email Security

Critical Zero-Day Flaw in Barracuda Email Security Gateway (CVE-2023-7102) Overview A severe zero-day vulnerability, designated CVE-2023-7102, has been discovered in the Barracuda Email Security Gateway This flaw enables attackers to execute arbitrary code on vulnerable systems Impact Remote code execution Possible data theft and system compromise Disruption of email service

CWE-94 https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2023/MNDT-2023-0019.md https://https://www.cve.org/CVERecord?id=CVE-2023-7101 https://https://metacpan.org/dist/Spreadsheet-ParseExcel https://https://github.com/haile01/perl_spreadsheet_excel_rce_poc https://github.com/jmcnamara/spreadsheet-parseexcel/blob/c7298592e102a375d43150cd002feed806557c15/lib/Spreadsheet/ParseExcel/Utility.pm#L171 http://www.openwall.com/lists/oss-security/2023/12/29/4 https://lists.debian.org/debian-lts-announce/2023/12/msg00025.html https://https://github.com/jmcnamara/spreadsheet-parseexcel/commit/bd3159277e745468e2c553417b35d5d7dc7405bc https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IFEHKULQRVXHIV7XXK2RGD4VQN6Y4CV5/https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M2FIWDHRYTAAQLGM6AFOZVM7AFZ4H2ZR/https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1059450 https://nvd.nist.gov https://github.com/vinzel-ops/vuln-barracuda https://alas.aws.amazon.com/ALAS-2024-1905.html

CVE-2023-7101

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Mailing Lists

Github Repositories

References

Vulmon Search

About

Products

Connect