CVE-2013-6836
Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in...
CVE-2013-6836 is a medium vulnerability (CVSS 4.3) in Gnome Gnumeric, published December 19, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.75%, the 77th percentile. Fixed in gnumeric 1.12.9-1.
Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service (crash) via a crafted xls file with a crafted length value.
Exploit likelihood
What each source reports
NVD Score used
Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service (crash) via a crafted xls file with a crafted length value.
- Record
CVE-2013-6836- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service (crash) via a crafted xls file with a crafted length value.
- Record
CVE-2013-6836- Updated
- 2026-11-02
EUVDEUVD-2013-6638 No score
Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service (crash) via a crafted xls file with a crafted length value.
- Record
EUVD-2013-6638- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2252-2x7m-w7r8 No score
Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in...
Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service (crash) via a crafted xls file with a crafted length value.
- Record
GHSA-2252-2x7m-w7r8- Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service (crash) via a crafted xls file with a crafted length value.
- Record
CVE-2013-6836- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-6836 No score
Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service (crash) via a crafted xls file with a crafted length value.
- Record
DEBIAN-CVE-2013-6836- Updated
- 2026-11-02
OSVMGASA-2014-0086 No score
Updated gnome-chemistry-utils, gnumeric and goffice packages fix security vulnerability
Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service (crash) via a crafted xls file with a crafted length value. (CVE-2013-6836)
- Record
MGASA-2014-0086- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-6836 No score
Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service (crash) via a crafted xls file with a crafted length value.
- Record
UBUNTU-CVE-2013-6836- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gnumericDebian:12 |
before 1.12.9-1 | 1.12.9-1 |
gnumericDebian:13 |
before 1.12.9-1 | 1.12.9-1 |
gnumericDebian:14 |
before 1.12.9-1 | 1.12.9-1 |
gnome-chemistry-utilsMageia:3 |
before 0.14.5-1.mga3 | 0.14.5-1.mga3 |
gnumericMageia:3 |
before 1.12.9-1.mga3 | 1.12.9-1.mga3 |
gofficeMageia:3 |
before 0.10.9-1.mga3 | 0.10.9-1.mga3 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | affected | |
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
lists.opensuse.org/opensuse-updates/2014-02/msg00018.html
git.gnome.org/browse/gnumeric/commit?id=b5480b69345b3c6d56ee0ed9c9e9880bb2a08cdc
securityfocus.com/bid/64459
bugzilla.gnome.org/show_bug.cgi?id=712772
projects.gnome.org/gnumeric/announcements/1.12/gnumeric-1.12.9.shtml
secunia.com/advisories/56678
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-6836
github.com/advisories/GHSA-2252-2x7m-w7r8
security-tracker.debian.org/tracker/CVE-2013-6836
advisories.mageia.org/MGASA-2014-0086.html
bugs.mageia.org/show_bug.cgi?id=12294
bugzilla.redhat.com/show_bug.cgi?id=1044857
ubuntu.com/security/CVE-2013-6836
cve.org/CVERecord?id=CVE-2013-6836