CVE-2017-2923
An exploitable heap based buffer overflow vulnerability exists in the 'read_biff_next_record...
An exploitable heap based buffer overflow vulnerability exists in the 'read_biff_next_record function' of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
An exploitable heap based buffer overflow vulnerability exists in the 'read_biff_next_record function' of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.
- Record
CVE-2017-2923- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
EUVDEUVD-2017-12064
An exploitable heap based buffer overflow vulnerability exists in the 'read_biff_next_record function' of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.
- Record
EUVD-2017-12064- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3wq9-hv2f-46q4
An exploitable heap based buffer overflow vulnerability exists in the 'read_biff_next_record...
An exploitable heap based buffer overflow vulnerability exists in the 'read_biff_next_record function' of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.
- Record
GHSA-3wq9-hv2f-46q4- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-119, CWE-787
- Updated
- 2026-11-02
NVD
An exploitable heap based buffer overflow vulnerability exists in the 'read_biff_next_record function' of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.
- Record
CVE-2017-2923- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
An exploitable heap based buffer overflow vulnerability exists in the 'read_biff_next_record function' of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.
- Record
CVE-2017-2923- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-2923
An exploitable heap based buffer overflow vulnerability exists in the 'read_biff_next_record function' of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.
- Record
DEBIAN-CVE-2017-2923- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2017-2923
An exploitable heap based buffer overflow vulnerability exists in the 'read_biff_next_record function' of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.
- Record
UBUNTU-CVE-2017-2923- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2017:2537-1 No score
Security update for freexl
This update for freexl to version 1.0.4 fixes several issues.
These security issues were fixed:
- CVE-2017-2924: Prevent heap-based buffer overflow in the read_legacy_biff function (bsc#1058433).
- CVE-2017-2923: Prevent heap-based buffer overflow in the read_biff_next_record function (bsc#1058431).
- Record
openSUSE-SU-2017:2537-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2017:2539-1 No score
Security update for freexl
This update for freexl to version 1.0.4 fixes several issues.
These security issues were fixed:
- CVE-2017-2924: Prevent heap-based buffer overflow in the read_legacy_biff function (bsc#1058433).
- CVE-2017-2923: Prevent heap-based buffer overflow in the read_biff_next_record function (bsc#1058431).
- Record
openSUSE-SU-2017:2539-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10771-1 No score
freexl-devel-1.0.6-1.3 on GA media
These are all security issues fixed in the freexl-devel-1.0.6-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10771-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
freexlDebian:12 |
before 1.0.4-1 | 1.0.4-1 |
freexlDebian:13 |
before 1.0.4-1 | 1.0.4-1 |
freexlDebian:14 |
before 1.0.4-1 | 1.0.4-1 |
freexlDebian:7 |
before 1.0.0b-1+deb7u4, plus listed versions 1.0.0b-11.0.0b-1+deb7u11.0.0b-1+deb7u21.0.0b-1+deb7u3 |
1.0.0b-1+deb7u4 |
freexlDebian:8 |
before 1.0.0g-1+deb8u4, plus listed versions 1.0.0g-1+deb8u11.0.0g-1+deb8u21.0.0g-1+deb8u3 |
1.0.0g-1+deb8u4 |
freexlDebian:9 |
before 1.0.2-2+deb9u1, plus listed versions 1.0.2-2 |
1.0.2-2+deb9u1 |
freexlUbuntu:14.04:LTS |
before 1.0.0g-1ubuntu0.14.04.3, plus listed versions 1.0.0d-11.0.0f-11.0.0f-21.0.0g-11.0.0g-1ubuntu0.14.04.11.0.0g-1ubuntu0.14.04.2 |
1.0.0g-1ubuntu0.14.04.3 |
freexlUbuntu:16.04:LTS |
before 1.0.2-1ubuntu0.1, plus listed versions 1.0.2-1 |
1.0.2-1ubuntu0.1 |
freexlSUSE:Package Hub 12 |
before 1.0.4-5.1 | 1.0.4-5.1 |
freexlopenSUSE:Tumbleweed |
before 1.0.6-1.3 | 1.0.6-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-2923 is a high vulnerability (CVSS 8.8) in Alessandro Furieri Freexl, published September 17, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.20%, the 88th percentile. Fixed in freexl 1.0.4-1.
References
debian.org/security/2017/dsa-3976
securityfocus.com/bid/100807
talosintelligence.com/vulnerability_reports/TALOS-2017-0430
nvd.nist.gov/vuln/detail/CVE-2017-2923
github.com/advisories/GHSA-3wq9-hv2f-46q4
security-tracker.debian.org/tracker/CVE-2017-2923
Show 11 moreShow less
ubuntu.com/security/CVE-2017-2923
cve.org/CVERecord?id=CVE-2017-2923
bugzilla.suse.com/1058431
suse.com/security/cve/CVE-2017-2923