Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in FreeXL
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in FreeXL
ID: 201606-15
Distribution: Gentoo
Plattformen: Keine Angabe
Datum: Mo, 27. Juni 2016, 07:28
Referenzen: http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2776
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2753
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2754
Applikationen: freexl

Originalnachricht

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--7Dbf3BR6hR2Ob8x2jDuE5Di5H6kP4CdVU
Content-Type: multipart/mixed;
boundary="1k8LTMS5urFgwssFKPA5Nc98danCXe26d"
From: Aaron Bauman <bman@gentoo.org>
To: gentoo-announce@lists.gentoo.org
Message-ID: <2d7f1647-c043-cfe2-7a89-e0d2412a6022@gentoo.org>
Subject: [ GLSA 201606-15 ] FreeXL: Multiple vulnerabilities

--1k8LTMS5urFgwssFKPA5Nc98danCXe26d
Content-Type: multipart/alternative;
boundary="------------DEA4F7A70F2DABB5BFBF950A"

This is a multi-part message in MIME format.
--------------DEA4F7A70F2DABB5BFBF950A
Content-Type: text/plain; charset=utf-
Content-Transfer-Encoding: quoted-printable

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201606-15
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: FreeXL: Multiple vulnerabilities
Date: June 26, 2016
Bugs: #544426
ID: 201606-15

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been found in FreeXL, allowing remote
attackers to executive arbitrary code or cause Denial of Service.

Background
==========

FreeXL is an open source library to extract valid data from within an
Excel (.xls) spreadsheet.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 dev-libs/freexl < 1.0.1 >= 1.0.1

Description
===========

FreeXL's shared strings and workbook functions are vulnerable to the
remote execution of arbitrary code and Denial of Service. This can be
achieved through specially crafted workbooks from attackers.

Impact
======

Remote attackers could potentially execute arbitrary code or cause
Denial of Service.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All FreeXL users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose "dev-libs/freexl-1.0.1"

References
==========

[ 1 ] CVE-2015-2753
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2753
[ 2 ] CVE-2015-2754
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2754
[ 3 ] CVE-2015-2776
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2015-2776

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/201606-15

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2016 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

http://creativecommons.org/licenses/by-sa/2.5


--------------DEA4F7A70F2DABB5BFBF950A
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: quoted-printable

<html>
<head>

<meta http-equiv=3D"Content-Type" content=3D"text/html;
charset=3Dutf=
-8">
</head>
<body bgcolor=3D"#FFFFFF" text=3D"#000000">
<p>
<meta http-equiv=3D"Content-Type" content=3D"text/html;
charset=3Du=
tf-8">
</p>
<pre style=3D"color: rgb(0, 0, 0); font-style: normal; font-variant:
=
normal; font-weight: normal; letter-spacing: normal; line-height: normal;=
orphans: auto; text-align: start; text-indent: 0px; text-transform: none=
; widows: 1; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap=
: break-word; white-space: pre-wrap;">- - - - - - - - - - - - - - - - -
-=
- - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201606-15
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
<a
class=3D"moz-txt-link-freet=
ext" href=3D"https://security.gentoo.org/">https://security.gentoo.org/</=
a>
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Normal
Title: FreeXL: Multiple vulnerabilities
Date: June 26, 2016
Bugs: #544426
ID: 201606-15

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
=3D=3D=3D=3D=3D=3D=3D=3D

Multiple vulnerabilities have been found in FreeXL, allowing remote
attackers to executive arbitrary code or cause Denial of Service.

Background
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

FreeXL is an open source library to extract valid data from within an
Excel (.xls) spreadsheet.

Affected packages
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 dev-libs/freexl &lt; 1.0.1 &gt;=3D
1=
=2E0.1=20

Description
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

FreeXL's shared strings and workbook functions are vulnerable to the
remote execution of arbitrary code and Denial of Service. This can be
achieved through specially crafted workbooks from attackers.

Impact
=3D=3D=3D=3D=3D=3D

Remote attackers could potentially execute arbitrary code or cause
Denial of Service.

Workaround
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

There is no known workaround at this time.

Resolution
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

All FreeXL users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose "dev-libs/freexl-1.0.1"

References
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

[ 1 ] CVE-2015-2753
<a class=3D"moz-txt-link-freetext" href=3D"http://nvd.nist.gov/nvd.=
cfm?cvename=3DCVE-2015-2753">http://nvd.nist.gov/nvd.cfm?cvename=3DCVE-20=
15-2753</a>
[ 2 ] CVE-2015-2754
<a class=3D"moz-txt-link-freetext" href=3D"http://nvd.nist.gov/nvd.=
cfm?cvename=3DCVE-2015-2754">http://nvd.nist.gov/nvd.cfm?cvename=3DCVE-20=
15-2754</a>
[ 3 ] CVE-2015-2776
<a class=3D"moz-txt-link-freetext" href=3D"http://nvd.nist.gov/nvd.=
cfm?cvename=3DCVE-2015-2776">http://nvd.nist.gov/nvd.cfm?cvename=3DCVE-20=
15-2776</a>

Availability
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

<a class=3D"moz-txt-link-freetext" href=3D"https://security.gentoo.org/g=
lsa/201606-15">https://security.gentoo.org/glsa/201606-15</a>

Concerns?
=3D=3D=3D=3D=3D=3D=3D=3D=3D

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
<a class=3D"moz-txt-link-abbreviated"
href=3D"mailto:security@gentoo.org"=
>security@gentoo.org</a> or alternatively, you may file a bug at
<a class=3D"moz-txt-link-freetext" href=3D"https://bugs.gentoo.org">https=
://bugs.gentoo.org</a>.

License
=3D=3D=3D=3D=3D=3D=3D

Copyright 2016 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

<a class=3D"moz-txt-link-freetext" href=3D"http://creativecommons.org/lic=
enses/by-sa/2.5">http://creativecommons.org/licenses/by-sa/2.5</a></pre>
</body>
</html>

--------------DEA4F7A70F2DABB5BFBF950A--

--1k8LTMS5urFgwssFKPA5Nc98danCXe26d--

--7Dbf3BR6hR2Ob8x2jDuE5Di5H6kP4CdVU
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.1

iQJ8BAEBCgBmBQJXcGtFXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXQ1OTcyRDI4NDhFOEE0NDYwRTdERTY4QUM5
RjI4QkQ4QkQxRTM5NUZGAAoJEJ8ovYvR45X/Q88P/jlZCA6ZwU8V0RwqMBilkKPU
3d5//Q9jMuQ/EHtxKXzFHDn1rXq2Tc3Rqk8ikB2wTDtiv+w+DLI/yxq7vaZXTI6M
V34KyGFEB9PHDzs5oprDbBmj9+Hiyh/0mQhtgt15xGQ95AIsa0PjzWfKj89Ja38+
kwPv4ULFWH8W2l3RmulfEr4YxeF8DCKOkQ9qg5yN0btTTRkN3J33iXtv9gyebzeU
/dE0T9oT8FSRZP5XG7yNWV0jIEUUn/lbJPKziRXvYG+ZENQ9V6beP0eV6ZqsYpB+
JcMpApnzRd2WJ/EjyhWRn2fCjeTdMyr16vqYeNgUS5CjP7rJgbZXI7EO9CvrGUWG
X4G36HW9Wn+v86Y5HRf+Ing1s+gAyLFtQvvoo2/GNC2HUImvNRdJJGTiOjD3B54c
twtTLyUlKfMcQAlTk9vednxf6uKC7S9+WIf4TWOeBygDH8lSUp/HckCp+srFCC37
cPleZsaDFDqq4KbyS3/iV7+DdaQ3V81R55hhR2DsjZzZIftkCThHv/13AmT7YQKs
NPkLjwER3RXbWmaqK7wzCZqB9duGyX2uMYYWl76MCiN6/upUAm4TLZ/mmWp2tNku
IQyzU9FNswmWyr652LOMPTpeZjJjRbOO+Aa90KgHEzKam16fL4HRkw0AtNwoTJMf
LrPFQ1IM32RtZyqKSNI9
=K3eK
-----END PGP SIGNATURE-----

--7Dbf3BR6hR2Ob8x2jDuE5Di5H6kP4CdVU--
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung