CVE-2015-2776

Published: Mar 31, 2015Modified: May 6, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

The parse_SST function in FreeXL before 1.0.0i allows remote attackers to cause a denial of service (memory consumption) via a crafted shared strings table in a workbook.

Affected (2)

Products: Debian: Debian Linux · Gaia Gis: Freexl

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Gaia Gis Freexl	Up to 1.0.0h

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (14)

http://www.debian.org/security/2015/dsa-3208

Source: cve@mitre.org

Third Party Advisory

http://www.openwall.com/lists/oss-security/2015/03/25/1

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2015/03/27/13

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2015/03/27/5

Source: cve@mitre.org

http://www.securityfocus.com/bid/73330

Source: cve@mitre.org

https://security.gentoo.org/glsa/201606-15

Source: cve@mitre.org

Third Party Advisory

https://www.gaia-gis.it/fossil/freexl/fdiff?v1=2e167b337481dda3&v2=61618ce51a9b0c15&sbs=1

Source: cve@mitre.org

http://www.debian.org/security/2015/dsa-3208