The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the no_xxe option of XML::Twig.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6769-1 advisory.

    Le Dinh Hai discovered that Spreadsheet::ParseXLSX did not properly manage memory during cell merge     operations. An attacker could possibly use this issue to consume large amounts of memory, resulting in a     denial of service condition. (CVE-2024-22368)

    An Pham discovered that Spreadsheet::ParseXLSX allowed the processing of external entities in a default     configuration. An attacker could possibly use this vulnerability to execute an XML External Entity (XXE)     injection attack. (CVE-2024-23525)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3723 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3723-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     January 27, 2024                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libspreadsheet-parsexlsx-perl     Version        : 0.27-2+deb10u1     CVE ID         : CVE-2024-22368 CVE-2024-23525     Debian Bug     : 1061098

    Security vulnerabilities were found in libspreadsheet-parsexlsx-perl, a     Perl module to parse XLSX files, which could lead to denial of service     or server-side request forgery via crafted input.

    CVE-2024-22368

        Le Dinh Hai discovered that the memoize implementation allows         attacker to allocate an arbitrary memory size, which could lead to         denial of service via memory exhaustion.

    CVE-2024-23525

        An Pham discovered an XML external entity (XXE) vulnerability via         crafted input, which could lead to denial of service or server-side         request forgery.

    For Debian 10 buster, these problems have been fixed in version     0.27-2+deb10u1.

    We recommend that you upgrade your libspreadsheet-parsexlsx-perl packages.

    For the detailed security status of libspreadsheet-parsexlsx-perl please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libspreadsheet-parsexlsx-perl

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
195222	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : Spreadsheet::ParseXLSX vulnerabilities (USN-6769-1)	Nessus	Ubuntu Local Security Checks	medium
189722	Debian dla-3723 : libspreadsheet-parsexlsx-perl - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2024-23525

medium

Tenable Plugins

medium

medium