CVE-2020-27819: 
NixOS vulnerability analysis and mitigation

An issue was discovered in libxls before and including 1.6.1 when reading Microsoft Excel files. A NULL pointer dereference vulnerability exists when parsing XLS cells in libxls/xls2csv.c:199. It could allow a remote attacker to cause a denial of service via crafted XLS file (NVD, RedHat).

The vulnerability is classified as a NULL pointer dereference issue in the XLS cell parsing functionality, specifically located in libxls/xls2csv.c at line 199. The CVSS v3.1 base score is 5.5 (MEDIUM) with a vector of CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. The vulnerability is tracked under CWE-476 (NULL Pointer Dereference) (NVD).

The highest impact of this vulnerability is to application availability. A successful exploitation could result in a denial of service condition when processing crafted XLS files (NVD).

The vulnerability requires user interaction to open a malicious XLS file. An attacker can trigger the vulnerability by crafting a specific XLS file that, when processed by the affected libxls versions, causes a NULL pointer dereference (NVD).

The vulnerability has been fixed in libxls version 1.6.2. Users are advised to upgrade to this version or later to address the vulnerability (RedHat).