Outdated xlsxio sources (CVE-2023-34795)

[Garnik645]

The master branch of the project contains unpatched sources from xlsxio, in which CVE-2023-34795 was reported with high severity. The function xlsxioread_sheetlist_open() from php-ext-xlswriter/library/libxlsxio/lib/xlsxio_read.c does not include security patches and updates available in newer versions of xlsxio, which can cause free of uninitialized pointer in the xlsxioread_sheetlist_close() function. The fix for CVE can be found in this commit: xlsxio commit.

If xlsxio sources are used somewhere, I recommend updating them to the latest version.

My report was primarily based on a static analysis tool developed at CAST, which flagged the potential vulnerability due to similarities in the codebase.

[YeharaDananjaya]

maybe this solution will solve your problem click