Freexl Project Freexl vulnerabilities

CVE-2017-2924 [HIGH] CWE-787 CVE-2017-2924: An exploitable heap-based buffer overflow vulnerability exists in the read_legacy_biff function of F An exploitable heap-based buffer overflow vulnerability exists in the read_legacy_biff function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.

CVE-2017-2923 [HIGH] CWE-787 CVE-2017-2923: An exploitable heap based buffer overflow vulnerability exists in the 'read_biff_next_record functio An exploitable heap based buffer overflow vulnerability exists in the 'read_biff_next_record function' of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.

CVE-2018-7436 [HIGH] CWE-125 CVE-2018-7436: An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in a pointer An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in a pointer dereference of the parse_SST function.

CVE-2018-7439 [HIGH] CWE-125 CVE-2018-7439: An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the functi An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the function read_mini_biff_next_record.

CVE-2018-7435 [HIGH] CWE-125 CVE-2018-7435: An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the freexl An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the freexl::destroy_cell function.

CVE-2015-2753 [MEDIUM] CVE-2015-2753: FreeXL before 1 FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) or possibly execute arbitrary code via a crafted sector in a workbook.

CVE-2015-2754 [MEDIUM] CVE-2015-2754: FreeXL before 1 FreeXL before 1.0.0i allows remote attackers to cause a denial of service (stack corruption) and possibly execute arbitrary code via a crafted workbook, related to a "premature EOF."

CVE-2018-7438 [HIGH] CWE-125 CVE-2018-7438: An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the parse_ An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in the parse_unicode_string function.

CVE-2018-7437 [HIGH] CWE-125 CVE-2018-7437: An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in a memcpy c An issue was discovered in FreeXL before 1.0.5. There is a heap-based buffer over-read in a memcpy call of the parse_SST function.

CVE-2015-2776 [MEDIUM] CVE-2015-2776: The parse_SST function in FreeXL before 1 The parse_SST function in FreeXL before 1.0.0i allows remote attackers to cause a denial of service (memory consumption) via a crafted shared strings table in a workbook.