CVE-2023-38854: 
NixOS vulnerability analysis and mitigation

Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted XLS file to the transcode_latin1_to_utf8 function in xlstool.c:296 (NVD). The vulnerability was discovered in July 2023 and affects the libxls library version 1.6.2.

The vulnerability is a heap-based buffer overflow that occurs in multiple locations within the libxls codebase, with the primary issue in the transcode_latin1_to_utf8 function at xlstool.c:296. When processing a specially crafted XLS file, the function attempts to read beyond allocated memory boundaries, leading to a buffer overflow condition. The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD, GitHub Issue).

The exploitation of this vulnerability can lead to arbitrary code execution or cause a denial of service condition. When a maliciously crafted XLS file is processed by an application using the affected libxls library, an attacker can potentially execute arbitrary code or crash the application (NVD).

The vulnerability can be triggered remotely by providing a specially crafted XLS file to any application that uses the affected libxls library. The attack requires user interaction to open the malicious file. Proof of concept code and crash inputs have been publicly documented (GitHub Issue).