CVE-2018-20452 | BDVDB-2026-110960 Detail

Description#

The read_MSAT_body function in ole.c in libxls 1.4.0 has an invalid free that allows attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted file, because of inconsistent memory management (new versus free) in ole2_read_header in ole.c.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/evanmiller/libxls/issues/35
https://security.gentoo.org/glsa/202003-64

Exploit#

No public exploit known

History#

Version 12018-12-25Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.