CVE-2015-2776 The parse_SST function in FreeXL before 1.0.0i allows remote attackers to cause a denial of service (memory consumption) via a crafted shared strings table in a workbook.
MediumCVSS 4.3
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The parse_SST function in FreeXL before 1.0.0i allows remote attackers to cause a denial of service (memory consumption) via a crafted shared strings table in a workbook.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/freexl(Debian:12) | < 1.0.0g-1+deb8u1 | 1.0.0g-1+deb8u1 |
| debian/freexl(Debian:13) | < 1.0.0g-1+deb8u1 | 1.0.0g-1+deb8u1 |
| debian/freexl(Debian:14) | < 1.0.0g-1+deb8u1 | 1.0.0g-1+deb8u1 |
| debian linux | = 7.0 | No fix listed |
| gaia-gis freexl | <= 1.0.0h | No fix listed |
References
- Debian Security Tracker CVE-2015-2776 vendor-advisory
- DSA-3208 third-party-advisory vendor-advisory
- [oss-security] 20150324 CVE Request: Multiple vulnerabilities in freexl 1.0.0g mailing-list
- [oss-security] 20150327 Re: CVE Request: Multiple vulnerabilities in freexl 1.0.0g mailing-list
- [oss-security] 20150327 Re: CVE Request: Multiple vulnerabilities in freexl 1.0.0g mailing-list
- 73330 vdb-entry
- GLSA-201606-15 third-party-advisory vendor-advisory
- www.gaia-gis.it
- bugs.debian.org issue-tracking