Test ID:	1.3.6.1.4.1.25623.1.1.12.2024.6769.1
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-6769-1)
Summary:	The remote host is missing an update for the 'libspreadsheet-parsexlsx-perl' package(s) announced via the USN-6769-1 advisory.
Description:	Summary: The remote host is missing an update for the 'libspreadsheet-parsexlsx-perl' package(s) announced via the USN-6769-1 advisory. Vulnerability Insight: Le Dinh Hai discovered that Spreadsheet::ParseXLSX did not properly manage memory during cell merge operations. An attacker could possibly use this issue to consume large amounts of memory, resulting in a denial of service condition. (CVE-2024-22368) An Pham discovered that Spreadsheet::ParseXLSX allowed the processing of external entities in a default configuration. An attacker could possibly use this vulnerability to execute an XML External Entity (XXE) injection attack. (CVE-2024-23525) Affected Software/OS: 'libspreadsheet-parsexlsx-perl' package(s) on Ubuntu 20.04, Ubuntu 22.04, Ubuntu 23.10. Solution: Please install the updated package(s). CVSS Score: 7.8 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2024-22368 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WNJVC4C5C5V44DNOZ5BHVU53CDXPB2OJ/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6R7NYWVVZYDZIQC5YEXNHZM6VEE26SJV/ https://github.com/haile01/perl_spreadsheet_excel_rce_poc/blob/main/parse_xlsx_bomb.md https://metacpan.org/dist/Spreadsheet-ParseXLSX/changes https://security.metacpan.org/2024/02/10/vulnerable-spreadsheet-parsing-modules.html https://lists.debian.org/debian-lts-announce/2024/01/msg00018.html http://www.openwall.com/lists/oss-security/2024/01/10/2 Common Vulnerability Exposure (CVE) ID: CVE-2024-23525 https://gist.github.com/phvietan/d1c95a88ab6e17047b0248d6bf9eac4a https://github.com/MichaelDaum/spreadsheet-parsexlsx/issues/10 https://metacpan.org/release/NUDDLEGG/Spreadsheet-ParseXLSX-0.30/changes http://www.openwall.com/lists/oss-security/2024/01/18/4
Copyright	Copyright (C) 2024 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.