Vulnerabilities

catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode_string() in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count.

catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of process_item() in src/xlsparse.c that allows attackers to read past the static rec buffer via a crafted end column.

An integer overflow vulnerability exists in the OLE Document File Allocation Table Parser functionality of catdoc 0.95.

An integer underflow vulnerability exists in the OLE Document DIFAT Parser functionality of catdoc 0.95.

msxlsview.sh in xlsview for catdoc 0.91 and earlier allows local users to overwrite arbitrary files via a symlink attack on predictable temporary file names ("word$$.html").