openSUSE-SU-2026:22128-1

See a problem?

Import Source

https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22128-1.json

JSON Data

https://api.osv.dev/v1/vulns/openSUSE-SU-2026:22128-1

Upstream

CVE (2)

Related

CVE (2)

Published

2026-10-19T15:30:18Z

Modified

2026-10-20T19:15:04Z

Summary

Security update for libxls

Details

This update for libxls fixes the following issues:

Changes in libxls:

Update to release 1.6.4:

Fix use of uninitialized memory in OLE parsing [boo#1267687, CVE-2026-26825]
Fix use of uninitialized memory in read_MSAT [boo#1267608, CVE-2026-26824]
Fix use of uninitialized memory in xls_parseWorkBook
Fix out-of-bounds reads in the formula dumper
Handle allocation failures in OLE, workbook and string code
Read SummaryInformation streams at their real size
Keep full precision when converting numeric cells to strings
Fix "creation of UTF-8 locale failed" in xls2csv

Update to release 1.6.3:

Fix style record size check on big-endian systems
Fix header include in C++ mode
Fix buffer overflows when parsing style records
Fix infinite loop with self-referencing sectors

References

Affected packages

openSUSE:Leap 16.0 / libxls

Package

Name: libxls
Purl: pkg:rpm/opensuse/libxls&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.6.4-bp160.1.1

Ecosystem specific

{
    "binaries":  [
        {
            "libxls-devel":  "1.6.4-bp160.1.1",
            "libxls-tools":  "1.6.4-bp160.1.1",
            "libxlsreader8":  "1.6.4-bp160.1.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22128-1.json"