Vulnerabilities > CVE-2023-34795 - Use After Free vulnerability in Xlsxio Project Xlsxio

CVSS 7.8 - HIGH

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

local

low complexity

xlsxio-project

CWE-416

NVD

Published: 2023-06-16

Updated: 2023-06-27

Summary

xlsxio v0.1.2 to v0.2.34 was discovered to contain a free of uninitialized pointer in the xlsxioread_sheetlist_close() function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted XLSX file.

Vulnerable Configurations

Part	Description	Count
Application	Xlsxio_Project Xlsxio Project Xlsxio 0.1.2 Xlsxio Project Xlsxio 0.1.3 Xlsxio Project Xlsxio 0.1.4 Xlsxio Project Xlsxio 0.1.5 Xlsxio Project Xlsxio 0.1.6 Xlsxio Project Xlsxio 0.1.7 Xlsxio Project Xlsxio 0.1.8 Xlsxio Project Xlsxio 0.1.9 Xlsxio Project Xlsxio 0.2.0 Xlsxio Project Xlsxio 0.2.1 Xlsxio Project Xlsxio 0.2.2 Xlsxio Project Xlsxio 0.2.3 Xlsxio Project Xlsxio 0.2.5 Xlsxio Project Xlsxio 0.2.6 Xlsxio Project Xlsxio 0.2.7 Xlsxio Project Xlsxio 0.2.8 Xlsxio Project Xlsxio 0.2.10 Xlsxio Project Xlsxio 0.2.11 Xlsxio Project Xlsxio 0.2.12 Xlsxio Project Xlsxio 0.2.13 Xlsxio Project Xlsxio 0.2.14 Xlsxio Project Xlsxio 0.2.15 Xlsxio Project Xlsxio 0.2.16 Xlsxio Project Xlsxio 0.2.18 Xlsxio Project Xlsxio 0.2.19 Xlsxio Project Xlsxio 0.2.21 Xlsxio Project Xlsxio 0.2.22 Xlsxio Project Xlsxio 0.2.24 Xlsxio Project Xlsxio 0.2.25 Xlsxio Project Xlsxio 0.2.26 Xlsxio Project Xlsxio 0.2.27 Xlsxio Project Xlsxio 0.2.28 Xlsxio Project Xlsxio 0.2.29 Xlsxio Project Xlsxio 0.2.31 Xlsxio Project Xlsxio 0.2.32 Xlsxio Project Xlsxio 0.2.33 Xlsxio Project Xlsxio 0.2.34	37

Common Weakness Enumeration (CWE)

CWE-416 - Use After Free

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References