openSUSE-SU-2024:0021-1

    Dashboard / Vulnerabilities / openSUSE-SU-2024:0021-1

    openSUSE-SU-2024:0021-1

    Published: 16 Jan 2024Last Modified: 4 Feb 2026
    Upstream:
    CVE-2024-22368

    Summary: Security update for perl-Spreadsheet-ParseXLSX

    Details: This update for perl-Spreadsheet-ParseXLSX fixes the following issues: Updated to 0.29: see /usr/share/doc/packages/perl-Spreadsheet-ParseXLSX/Changes 0.29: - Fix for 'Argument '' isn't numeric in addition (+) at /usr/local/shar… - Incorrect cell values due to phonetic data doy#72 - Fix die message in parse() - Cannot open password protected SHA1 encrypted files. doy#68 - use date format detection based on Spreadsheet::XLSX - Add rudimentary support for hyperlinks in cells 0.28: - CVE-2024-22368: out-of-memory condition during parsing of a crafted XLSX document (boo#1218651) - Fix possible memory bomb as reported in https://github.com/haile01/perl_spreadsheet_excel_rce_poc/blob/main/parse_xlsx_bomb.md - Updated Dist::Zilla configuration fixing deprecation warnings

    References: https://lists.opensuse.org/archives/list/[email protected]/thread/EHHPL7IKGNQCRM3NOTRZRDYWT4OKW47L/, https://bugzilla.suse.com/1218651, https://www.suse.com/security/cve/CVE-2024-22368

    Affected packages

    Package

    Name: perl-Spreadsheet-ParseXLSX

    Purl: pkg:rpm/suse/perl-Spreadsheet-ParseXLSX&distro=SUSE%20Package%20Hub%2015%20SP5

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -0.290.0-bp155.2.3.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High