Multible unaddressed libxls vulnerabilities

[michaelquinn32]

Hi team!

Sorry to bother, but I wanted to reraise a few unaddressed libxls vulnerabilities with you.

• There are multiple heap-buffer-overflow vulnerability found in libxls libxls/libxls#124
• heap-buffer-overflow in xls_parseWorkBook src/xls.c:1015 in libxls/xls2csv libxls/libxls#126
• https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe%3A2.3%3Aa%3Alibxls_project%3Alibxls%3A1.6.2%3A-%3A*%3A*%3A*%3A*%3A*%3A*

FWIW, this is triggering internal security alerts for us. We will need to address them eventually. I think our route forward is to drop support for xls files.

Is there anything that can be done on your end?

Thanks!

[jennybc]

Is there anything that can be done on your end?

Unfortunately, no. I am not in a position to tackle these vulnerabilities myself.

I have, at times, vendored a dev version of libxls, in order to get some security fixes into readxl ASAP. But they need to be in libxls itself, obviously, for that to work.

[michaelquinn32]

Totally understand. I'm basically in the same boat, as we don't really have anyone who can take on fixing these issues right now.

If we can't get movement on this, the next step will be something like removing libxls and support for xls files. It's unfortunate, but at least it's a way to stop the security alerts.

[jennybc]

Have you tried reaching out to the libxls developer? No idea if this is a possibility, but maybe an offer to sponsor a targeted piece of work would be productive? It's not like removing xls support is a simple flick of a switch ....

[jennybc]

Thanks to @gaborcsardi, a patch has been made to libxls (libxls/libxls#129), so I will work on getting those changes into a readxl release in the near future.