https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 17:55:04 +0000 https://vulnerability.circl.lu/vuln/cve-2024-22368 <p>The Spreadsheet::ParseXLSX package before 0.28 for Perl can encounter an out-of-memory condition during parsing of a crafted XLSX document. This occurs because the memoize implementation does not have appropriate constraints on merged cells.</p> <p>The Spreadsheet::ParseXLSX package before 0.28 for Perl can encounter an out-of-memory condition during parsing of a crafted XLSX document. This occurs because the memoize implementation does not have appropriate constraints on merged cells.</p> https://vulnerability.circl.lu/vuln/cve-2024-22368 https://vulnerability.circl.lu/vuln/usn-6769-1 <p><strong>Affected:</strong> Ubuntu:20.04:LTS: libspreadsheet-parsexlsx-perl, Ubuntu:22.04:LTS: libspreadsheet-parsexlsx-perl</p> <p>Le Dinh Hai discovered that Spreadsheet::ParseXLSX did not properly manage memory during cell merge operations. An attacker could possibly use this issue to consume large amounts of memory, resulting in a denial of service condition. (CVE-2024-22368)</p> <p>An Pham discovered that Spreadsheet::ParseXLSX allowed the processing of external entities in a default configuration. An attacker could possibly use this vulnerability to execute an XML External Entity (XXE) injection attack. (CVE-2024-23525)</p> <p><strong>Affected:</strong> Ubuntu:20.04:LTS: libspreadsheet-parsexlsx-perl, Ubuntu:22.04:LTS: libspreadsheet-parsexlsx-perl</p> <p>Le Dinh Hai discovered that Spreadsheet::ParseXLSX did not properly manage memory during cell merge operations. An attacker could possibly use this issue to consume large amounts of memory, resulting in a denial of service condition. (CVE-2024-22368)</p> <p>An Pham discovered that Spreadsheet::ParseXLSX allowed the processing of external entities in a default configuration. An attacker could possibly use this vulnerability to execute an XML External Entity (XXE) injection attack. (CVE-2024-23525)</p> https://vulnerability.circl.lu/vuln/usn-6769-1