A memory corruption vulnerability exists in the Shared String Table Record Parser implementation in xls2csv utility version 0.95. A specially crafted malformed file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A memory corruption vulnerability exists in the Shared String Table Record Parser implementation in     xls2csv utility version 0.95. A specially crafted malformed file can lead to a heap buffer overflow. An     attacker can provide a malicious file to trigger this vulnerability. (CVE-2024-48877)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4234 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4234-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     June 30, 2025                                 https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : catdoc     Version        : 1:0.95-4.1+deb11u1     CVE ID         : CVE-2024-48877 CVE-2024-52035 CVE-2024-54028     Debian Bug     : 1107168

    Multiple vulnerabilities have been fixed in catdoc, a text extractor for     MS-Office files.

    CVE-2024-48877

        memory corruption

    CVE-2024-52035

        integer overflow

    CVE-2024-54028

        integer underflow

    For Debian 11 bullseye, these problems have been fixed in version     1:0.95-4.1+deb11u1.

    We recommend that you upgrade your catdoc packages.

    For the detailed security status of catdoc please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/catdoc

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5953 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-5953-1                   security@debian.org     https://www.debian.org/security/                     Salvatore Bonaccorso     June 29, 2025                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : catdoc     CVE ID         : CVE-2024-48877 CVE-2024-52035 CVE-2024-54028     Debian Bug     : 1107168

    Several vulnerabilities were discovered in catdoc, a text extractor for     MS-Office files, which may result in denial of service or the execution     of arbitrary code if a specially crafted file is processed.

    For the stable distribution (bookworm), these problems have been fixed     in version 1:0.95-6~deb12u1.

    We recommend that you upgrade your catdoc packages.

    For the detailed security status of catdoc please refer to its security     tracker page at:
    https://security-tracker.debian.org/tracker/catdoc

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
255488	Linux Distros Unpatched Vulnerability : CVE-2024-48877	Nessus	Misc.	high
240923	Debian dla-4234 : catdoc - security update	Nessus	Debian Local Security Checks	high
240918	Debian dsa-5953 : catdoc - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2024-48877

high

Tenable Plugins

high

high

high