Date: prev next · Thread: first prev next last
2023 Archives by date, by thread · List index

tl;dr Upgrade to 7.5.9 or 7.6.4


CVE-2023-6185: Improper input validation enabling arbitrary Gstreamer
pipeline injection

Fixed in: LibreOffice 7.5.9/7.6.3


LibreOffice supports embedded videos in file formats via platform
audio/video support. Typically under Linux this is via gstreamer. In
affected version of LibreOffice the filename of the embedded video is
not sufficiently escaped when passed to gstreamer enabling an attacker
to run arbitrary gstreamer plugins depending on what plugins are
installed on the target system.

Linux Users are recommended to upgrade to 7.5.9 or 7.6.3 to avoid this


CVE-2023-6186: Link targets allow arbitrary script execution

Fixed in: LibreOffice 7.5.9/7.6.4


LibreOffice supports hyperlinks. In addition to the typical common
protocols such as http/https hyperlinks can also have target URLs that
can launch built-in macros or dispatch built-in internal commands. In
affected version of LibreOffice there are scenarios where these can be
executed without warning if the user activates such hyperlinks. In
later versions the users's explicit macro execution permissions for the
document are now consulted if these non-typical hyperlinks can be
executed. The possibility to use these variants of hyperlink targets
for floating frames has been removed.

Users are recommended to upgrade to 7.5.9 or 7.6.4 to avoid this flaw.



Thanks to Reginaldo Silva of for finding and reporting
these issues.
Thanks to Collabora Productivity for providing fixes.

To unsubscribe e-mail to:
Posting guidelines + more:
List archive:
Privacy Policy:


Privacy Policy | Impressum (Legal Info) | Copyright information: Unless otherwise specified, all text and images on this website are licensed under the Creative Commons Attribution-Share Alike 3.0 License. This does not include the source code of LibreOffice, which is licensed under the Mozilla Public License (MPLv2). "LibreOffice" and "The Document Foundation" are registered trademarks of their corresponding registered owners or are in actual use as trademarks in one or more countries. Their respective logos and icons are also subject to international copyright laws. Use thereof is explained in our trademark policy.