ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Keywords match titles. Record type separates incidents, intel, and research from CVEs.

  1. Research · Dec 24, 2023 · ZeroDay Catalog

    Critical Remote Code Execution Vulnerability in Spreadsheet::ParseExcel

    A critical vulnerability has been identified in Spreadsheet::ParseExcel, allowing for arbitrary code execution due to improper input validation.

    What changed

    A significant vulnerability has been discovered in the Spreadsheet::ParseExcel Perl module, specifically version 0.65. This flaw allows for arbitrary code execution (ACE) due to the improper handling of unvalidated input during the parsing of Excel files.

    The vulnerability arises from the evaluation of Number format strings within the Excel parsing logic, which can lead to severe security implications.

    Who is affected

    Organizations utilizing the Spreadsheet::ParseExcel module in their applications are at risk. This includes a variety of sectors that rely on Perl for data processing.

    The vulnerability may expose sensitive systems to remote code execution attacks if exploited.

    • Users of Spreadsheet::ParseExcel version 0.65
    • Developers integrating Perl modules for Excel file handling
    • Organizations in sectors such as finance, healthcare, and education that process Excel files
    • Any entity relying on jmcnamara's Spreadsheet::ParseExcel for data parsing

    What to do

    Immediate action is recommended for all users of the affected version. It is crucial to assess the potential impact of this vulnerability on your systems and take steps to mitigate risks.

    Updating to a patched version or implementing alternative solutions for Excel file parsing should be prioritized.

    • Review and update to the latest version of Spreadsheet::ParseExcel as soon as it becomes available.
    • Implement input validation and sanitization measures in your applications to prevent arbitrary code execution.
    • Monitor security advisories from the vendor and relevant cybersecurity organizations for updates and patches.

    Original report

  2. Research · Dec 21, 2023 · ZeroDay Catalog

    Heap Buffer Overflow Vulnerability in Google Chromium WebRTC

    A heap buffer overflow vulnerability has been identified in Google Chromium's WebRTC, potentially allowing remote exploitation through crafted HTML.

    What changed

    A critical heap buffer overflow vulnerability has been discovered in the WebRTC component of Google Chromium. This flaw could be exploited by a remote attacker through a specially crafted HTML page, leading to potential heap corruption.

    The vulnerability poses significant risks to users, particularly in environments where real-time communication is essential.

    Who is affected

    The vulnerability primarily affects various web browsers that utilize the WebRTC framework, with Google Chrome being the most notable example.

    Organizations and individuals relying on real-time communication features in their web applications may also be at risk.

    • Google Chrome users
    • Developers utilizing WebRTC in their applications
    • Organizations implementing real-time communication solutions

    What to do

    It is crucial for users and organizations to stay informed about updates from Google regarding this vulnerability. Applying patches and updates as soon as they are available will mitigate the risks associated with this flaw.

    Regularly review security advisories and ensure that all web applications leveraging WebRTC are secure against potential exploitation.

    • Monitor Google security updates for patches related to this vulnerability.
    • Implement security best practices for web applications using WebRTC.
    • Educate users about the risks of interacting with untrusted HTML content.

    Original report