Description

SheetJS and SheetJS Pro through 0.16.9 allows attackers to cause a denial of service (memory consumption) via a crafted .xlsx document that is mishandled when read by xlsx.js (issue 2 of 2).

Remediation

References

https://sheetjs.com/pro

https://floqast.com/engineering-blog/post/fuzzing-and-parsing-securely/

https://www.npmjs.com/package/xlsx/v/0.17.0

https://www.oracle.com/security-alerts/cpujan2022.html

Related Vulnerabilities

CVE-2023-37478 Vulnerability in npm package @pnpm/exe

CVE-2022-46688 Vulnerability in maven package org.jenkins-ci.plugins:sonar-gerrit

CVE-2022-43670 Vulnerability in maven package org.apache.sling:org.apache.sling.cms

CVE-2015-5349 Vulnerability in maven package org.apache.directory.studio:org.apache.directory.studio.ldapbrowser.core

CVE-2016-0763 Vulnerability in maven package org.apache.tomcat.embed:tomcat-embed-core

Severity

Medium

Classification

CWE-400 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Tags

Product Vendor Advisory Third Party Advisory Patch