/ 
Spreadsheet-ParseExcel-0.2405 UNAUTHORIZED RELEASE
Security Advisories (1)
CVE-2023-7101 (2023-12-24)

Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.

Changes for version 0.2405

  • Mod FmtDefault : Fix 0x01 (='0') format (Thank you Marc Pohl for report)
  • Mod ParseExcel : Mod Parse Fh of CGI.pm and GLOB ref. (Thank you Nicholas Hamlin and Abe Daisuke for reports) Fix PrintArea detection (Thank you Todd A. Green for patch) Add custom palette support (Thank you Florian Pflug for patch) Fix _SetDimension prototype (Thank you David Dyck for patch)
  • Mod SaveParser : Mod return value of SaveParser (Thank you Iceman for patch)
  • Mod Utility : Mod $iAftP manipulation (Thank you Stanislav Sukholet for patch)

Modules

Spreadsheet::ParseExcel
Get information from Excel file UNAUTHORIZED
Spreadsheet::ParseExcel::SaveParser
Expand of Spreadsheet::ParseExcel with Spreadsheet::WriteExcel
Spreadsheet::ParseExcel::Utility
Utility function for Spreadsheet::ParseExcel

Provides

Spreadsheet::ParseExcel::Cell
in ParseExcel.pm
Spreadsheet::ParseExcel::Dump
in ParseExcel/Dump.pm
Spreadsheet::ParseExcel::FmtDefault
in ParseExcel/FmtDefault.pm
Spreadsheet::ParseExcel::FmtJapan
in ParseExcel/FmtJapan.pm
Spreadsheet::ParseExcel::FmtJapan2
in ParseExcel/FmtJapan2.pm
Spreadsheet::ParseExcel::FmtUnicode
in ParseExcel/FmtUnicode.pm
Spreadsheet::ParseExcel::Font
in ParseExcel.pm
Spreadsheet::ParseExcel::Format
in ParseExcel.pm
Spreadsheet::ParseExcel::SaveParser::Workbook
in ParseExcel/SaveParser.pm
Spreadsheet::ParseExcel::Workbook
in ParseExcel.pm
Spreadsheet::ParseExcel::Worksheet
in ParseExcel.pm

Examples

Other files