GHSA-28rm-rj57-qjpv

PHPExcel vulnerable to XXE attacks through libxml

Source: GitHub Advisory Database (reviewed) Moderate CVE-2014-2054

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	phpoffice/phpexcel	< 1.8.0	1.8.0

Details

As written in the advisory (Markdown source, shown as plain text).

PHPExcel before 1.8.0, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, does not disable external entity loading in libxml, which allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2014-2054 advisory
https://github.com/PHPOffice/PHPExcel/commit/e04bf7ed091b0a72d028eacf26d770b485d4e897 web
https://github.com/PHPOffice/PHPExcel package
https://github.com/PHPOffice/PHPExcel/blob/2b601574975acfb9d4378a788ed5f2b747958095/changelog.txt#L120 web
https://github.com/PHPOffice/PHPExcel/blob/develop/changelog.txt web
http://owncloud.org/about/security/advisories/oC-SA-2014-006 web