CVE-2018-20450

The read_MSAT function in ole.c in libxls 1.4.0 has a double free that allows attackers to cause a denial of service (application crash) via a crafted file, a different vulnerability than CVE-2017-2897.

References

Affected packages

Git / github.com/evanmiller/libxls

Affected ranges

Type

GIT

Repo

https://github.com/evanmiller/libxls

Events

Introduced

Last affected

ab544df742cf50c730d1b6e46c66e44e3e42399f

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.4.0"
        }
    ]
}

Affected versions

v0.*

v0.2.0

v0.3.0

v1.*

v1.0.0

v1.1.0

v1.2.0

v1.2.1

v1.3.0

v1.3.1

v1.3.2

v1.3.3

v1.3.4

v1.4.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-20450.json"