Ubuntu Security Notice 6781-1 - Le Dinh Hai discovered that Spreadsheet::ParseExcel was passing unvalidated input from a file into a string-type "eval". An attacker could craft a malicious file to achieve arbitrary code execution.
cbbc9336f0ab4f5ad4b0da404d1fa2f58da1f00404c2dbea318ee4148ecf03b9