An exploitable heap based buffer overflow vulnerability exists in the
'read_biff_next_record function' of FreeXL 1.0.3. A specially crafted XLS
file can cause a memory corruption resulting in remote code execution. An
attacker can send malicious XLS file to trigger this vulnerability.

It was discovered that FreeXL did not properly handle certain input, resulting
in a beap-based buffer overflow. If a user were tricked into opening a malicious
Excel spreadsheet, an attacker could execute arbitrary code.

mikesalvatore