CVE-2023-7101
Fixed in a distro release ExploitedEPSS 19%CVSS 7.8
Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.
Products: Douglas Wilson Spreadsheet::ParseExcel, jmcnamara spreadsheet\, debian_linux, fedoraproject fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | perl-Spreadsheet-ParseExcel | 0.6500-28.amzn2023.0.3 |
| Debian 10 | libspreadsheet-parseexcel-perl | 0.6500-1+deb10u1 |
| Debian 11 | libspreadsheet-parseexcel-perl | 0.6500-1.1+deb11u1 |
| Debian 12 | libspreadsheet-parseexcel-perl | 0.6500-4~deb12u1 |
| Debian 13 | libspreadsheet-parseexcel-perl | 0.6500-4 |
| Debian 14 | libspreadsheet-parseexcel-perl | 0.6500-4 |
| SUSE Enterprise Storage 7.1 | perl-Spreadsheet-ParseExcel | 0.65-150000.3.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | perl-Spreadsheet-ParseExcel | 0.65-150000.3.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | perl-Spreadsheet-ParseExcel | 0.65-150000.3.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS | perl-Spreadsheet-ParseExcel | 0.65-150000.3.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | perl-Spreadsheet-ParseExcel | 0.65-150000.3.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | perl-Spreadsheet-ParseExcel | 0.65-150000.3.3.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | perl-Spreadsheet-ParseExcel | 0.65-150000.3.3.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | perl-Spreadsheet-ParseExcel | 0.65-150000.3.3.1 |
| SUSE Linux Enterprise Real Time 15 SP4 | perl-Spreadsheet-ParseExcel | 0.65-150000.3.3.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | perl-Spreadsheet-ParseExcel | 0.65-150000.3.3.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | perl-Spreadsheet-ParseExcel | 0.65-150000.3.3.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | perl-Spreadsheet-ParseExcel | 0.65-150000.3.3.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | perl-Spreadsheet-ParseExcel | 0.65-150000.3.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | perl-Spreadsheet-ParseExcel | 0.65-150000.3.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | perl-Spreadsheet-ParseExcel | 0.65-150000.3.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | perl-Spreadsheet-ParseExcel | 0.65-150000.3.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | perl-Spreadsheet-ParseExcel | 0.65-150000.3.3.1 |
| SUSE Manager Proxy 4.3 | perl-Spreadsheet-ParseExcel | 0.65-150000.3.3.1 |
| SUSE Manager Server 4.3 | perl-Spreadsheet-ParseExcel | 0.65-150000.3.3.1 |
| Ubuntu 20.04 LTS | libspreadsheet-parseexcel-perl | 0.6500-1ubuntu0.20.04.1 |
| Ubuntu 22.04 LTS | libspreadsheet-parseexcel-perl | 0.6500-1.1ubuntu0.1 |
| Ubuntu Pro 14.04 LTS | libspreadsheet-parseexcel-perl | 0.5800-1ubuntu0.1~esm1 |
| Ubuntu Pro 16.04 LTS | libspreadsheet-parseexcel-perl | 0.6500-1ubuntu0.16.04.1~esm1 |
| Ubuntu Pro 18.04 LTS | libspreadsheet-parseexcel-perl | 0.6500-1ubuntu0.18.04.1~esm1 |
| openSUSE Leap 15.5 | perl-Spreadsheet-ParseExcel | 0.65-150000.3.3.1 |
| openSUSE Tumbleweed | perl-Spreadsheet-ParseExcel | 0.660.0-1.1 |