The Spreadsheet::ParseXLSX package before 0.28 for Perl can encounter an out-of-memory condition during parsing of a crafted XLSX document. This occurs because the memoize implementation does not have appropriate constraints on merged cells.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6769-1 advisory.

  - The Spreadsheet::ParseXLSX package before 0.28 for Perl can encounter an out-of-memory condition during     parsing of a crafted XLSX document. This occurs because the memoize implementation does not have     appropriate constraints on merged cells. (CVE-2024-22368)

  - The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the     no_xxe option of XML::Twig. (CVE-2024-23525)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-5f136f5d10 advisory.

  - The Spreadsheet::ParseXLSX package before 0.28 for Perl can encounter an out-of-memory condition during     parsing of a crafted XLSX document. This occurs because the memoize implementation does not have     appropriate constraints on merged cells. (CVE-2024-22368)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-fa14bfd3b5 advisory.

  - The Spreadsheet::ParseXLSX package before 0.28 for Perl can encounter an out-of-memory condition during     parsing of a crafted XLSX document. This occurs because the memoize implementation does not have     appropriate constraints on merged cells. (CVE-2024-22368)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3723 advisory.

  - The Spreadsheet::ParseXLSX package before 0.28 for Perl can encounter an out-of-memory condition during     parsing of a crafted XLSX document. This occurs because the memoize implementation does not have     appropriate constraints on merged cells. (CVE-2024-22368)

  - The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the     no_xxe option of XML::Twig. (CVE-2024-23525)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2024:0021-1 advisory.

  - The Spreadsheet::ParseXLSX package before 0.28 for Perl can encounter an out-of-memory condition during     parsing of a crafted XLSX document. This occurs because the memoize implementation does not have     appropriate constraints on merged cells. (CVE-2024-22368)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
195222	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : Spreadsheet::ParseXLSX vulnerabilities (USN-6769-1)	Nessus	Ubuntu Local Security Checks	medium
191039	Fedora 39 : perl-Spreadsheet-ParseXLSX (2024-5f136f5d10)	Nessus	Fedora Local Security Checks	medium
191037	Fedora 38 : perl-Spreadsheet-ParseXLSX (2024-fa14bfd3b5)	Nessus	Fedora Local Security Checks	medium
189722	Debian dla-3723 : libspreadsheet-parsexlsx-perl - security update	Nessus	Debian Local Security Checks	medium
189104	openSUSE 15 Security Update : perl-Spreadsheet-ParseXLSX (openSUSE-SU-2024:0021-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2024-22368

medium

Tenable Plugins

medium

medium

medium

medium

medium