CVE and update status of the FreeBSD ports tree4,826 unaddressed CVEs in 618 portsAll times are CET

Port details

math/libxls1.6.3

Extract Cell Data From Excel xls files

Maintainer
bapt@FreeBSD.org
Packages
libxls 1.6.3
Upstream
Higher version available: 1.6.4
CPE
libxls_project:libxls from the port
WWW
https://github.com/libxls/libxls
Links
cgit · VuXML

Unaddressed (2) · The CVE record lists this version as affected, no VuXML entry names the CVE

CVE-2026-268246.5published 2026-06-03

libxls through version 1.6.3 contains a use of uninitialized memory vulnerability in the OLE container parser. Memory allocated for the Master Sector Allocation Table (MSAT) in read_MSAT() is not fully initialized before being consumed by ole2_validate_sector_chain(), which may result in application crashes or potential information disclosure when processin…

CVE-2026-268255.3published 2026-06-03

A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xls_parseWorkBook() and is triggered by uninitialized heap memory originating from the OLE layer (ole2_read). The flaw is detectable with MemorySanitizer (MSAN) and can lead to undefined behavior, incorrect parsing logic, or potent…

VuXML only (0) · listed, port not fixed yet

None. pkg audit reports nothing for this version.

Fixed (0)

No VuXML entries for this package.

Commits (19)

Baptiste Daroussin (bapt) · 1.6.3
math/libxls: update 1.6.2 to 1.6.3

Bump sc-im reverse dependency.
cc0e228117
Muhammad Moinur Rahman (bofh) · 1.6.2_1
math/libxls: Fix build

Reported by:	antoine
Approved by:	portmgr (blanket)
c19bbc8b76
Baptiste Daroussin (bapt) · 1.6.2_1
manprefix: move the manpages for the ports I maintain to share/man
0ef221ab62
Dmitry Marakasov (amdmi3) · 1.6.2
*/*: update conflicts on bin/xls2csv in 4 ports

Conflicting ports:
- databases/xls2txt
- math/libxls
- textproc/catdoc
- textproc/p5-Spreadsheet-Read

PR:		248294
Reported by:	jbeich
0b2033c53d
Dmitry Marakasov (amdmi3) · 1.6.2
math/libxls, textproc/catdoc: add mutual conflicts

The ports conflict on bin/xls2csv. While here, a couple of minor
cosmetic fixes.

PR:		248294
Submitted by:	uzsolt@uzsolt.hu
Approved by:	maintainer timeout (bapt, 2+ years)
ee06ac7a6c
Stefan Eßer (se) · 1.6.2
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 1.6.2
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Stefan Eßer (se) · 1.6.2
math/libxls: Add CPE information

Approved by:	portmgr (blanket)
5c45309766
Mathieu Arnold (mat) · 1.6.2
One more small cleanup, forgotten yesterday. Reported by:	lwhsu
cf118ccf87
Mathieu Arnold (mat) · 1.6.2
Remove # $FreeBSD$ from Makefiles.
305f148f48
Baptiste Daroussin (bapt) · 1.6.2
Update to 1.6.2
daaed84ec7
Baptiste Daroussin (bapt) · 1.6.1
Update libxls to 1.6.1
9b644c49a5
Baptiste Daroussin (bapt) · 1.5.3
update to 1.5.3
a05ebb01bd
Baptiste Daroussin (bapt) · 1.5.2
update to 1.5.2
ea2d15f126
Gerald Pfeifer (gerald) · 1.5.1_1
Bump PORTREVISION for ports depending on the canonical version of GCC as defined in Mk/bsd.default-versions.mk which has moved from GCC 8.3 to GCC 9.1 under most circumstances now after revision 507371.

This includes ports
 - with USE_GCC=yes or USE_GCC=any,
 - with USES=fortran,
 - using Mk/bsd.octave.mk which in turn features USES=fortran, and
 - with USES=compiler specifying openmp, nestedfct, c11, c++0x, c++11-lang,
   c++11-lib, c++14-lang, c++17-lang, or gcc-c++11-lib
plus, everything INDEX-11 shows with a dependency on lang/gcc9 now.

PR:		238330
ea8c8ec7da
Piotr Kubaj (pkubaj) · 1.5.1
math/libxls: fix build

Add USES=compiler:c++11-lang:
configure: error: *** A compiler with support for C++11 language features is required.

Approved by:	mentors (implicite approval)
ed44f24fa0
Baptiste Daroussin (bapt) · 1.5.1
Update to 1.5.1
72f5c8677c
Baptiste Daroussin (bapt) · 1.5.0
Update to 1.5.0
87b7c17382
Baptiste Daroussin (bapt) · 1.4.0
Library for parsing Excel (XLS) files, with a sample program for converting Excel files into CSV.

WWW: http://libxls.sourceforge.net/
b6b1e272dd