An exploitable stack based buffer overflow vulnerability exists in the xls_getfcell function of libxls 1.3.4. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An exploitable stack based buffer overflow vulnerability exists in the xls_getfcell function of libxls     1.3.4. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An     attacker can send malicious XLS file to trigger this vulnerability (CVE-2017-2919)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202003-64 (libxls: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in libxls. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could entice a user to process a specially crafted       Excel file using libxls, possibly resulting in execution of arbitrary       code with the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Marcin Noga discovered multiple vulnerabilities in readxl, a GNU R package to read Excel files (via the integrated libxls library), which could result in the execution of arbitrary code if a malformed spreadsheet is processed.

ID	Name	Product	Family	Severity
255101	Linux Distros Unpatched Vulnerability : CVE-2017-2919	Nessus	Misc.	high
135019	GLSA-202003-64 : libxls: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
109065	Debian DSA-4173-1 : r-cran-readxl - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2017-2919

high

Tenable Plugins

high

high

high