#VU84092 OS Command Injection in LibreOffice - CVE-2023-6185
Vulnerability identifier: #VU84092
Vulnerability risk: High
CVSSv4.0: 5.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]
CVE-ID:
CWE-ID:
CWE-78
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
LibreOffice
Client/Desktop applications /
Office applications
Vendor: LibreOffice
Description
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of filenames of the embedded video files before passing it to gstreamer.
A remote attacker can create a specially crafted document with embedded
video inside, trick the victim into opening it and execute arbitrary
OS commands on the system.
Mitigation
Install updates from vendor's website.
Vulnerable software versions
LibreOffice: 7.0.0.1 - 7.0.0.3, 7.0.1.1 - 7.0.1.2, 7.0.2.1 - 7.0.2.2, 7.0.3.1, 7.0.4.1 - 7.0.4.2, 7.0.5.1 - 7.0.5.2, 7.0.6.1 - 7.0.6.2, 7.1.0.1 - 7.1.0.3, 7.1.1.1 - 7.1.1.2, 7.1.2.1 - 7.1.2.2, 7.1.3.1 - 7.1.3.2, 7.1.4.1 - 7.1.4.2, 7.1.5.1 - 7.1.5.2, 7.1.6.1 - 7.1.6.2, 7.1.7.1 - 7.1.7.2, 7.1.8.1, 7.2.0.1 - 7.2.0.4, 7.2.1.1 - 7.2.1.2, 7.2.2.1 - 7.2.2.2, 7.2.3.1 - 7.2.3.2, 7.2.4.1, 7.2.5.1 - 7.2.5.2, 7.2.6.1 - 7.2.6.2, 7.2.7.1 - 7.2.7.2, 7.3.0.1 - 7.3.0.3, 7.3.1.1 - 7.3.1.3, 7.3.2.1 - 7.3.2.2, 7.3.3.1 - 7.3.3.2, 7.3.4.1 - 7.3.4.2, 7.3.5.1 - 7.3.5.2, 7.3.6.1, 7.3.6.2, 7.3.7.1, 7.3.7.2, 7.4.0.1 - 7.4.0.3, 7.4.1.1, 7.4.1.2, 7.4.2.1, 7.4.2.2, 7.4.2.3, 7.4.3.1, 7.4.3.2, 7.4.4.1, 7.4.4.2, 7.4.5.1, 7.4.6.1, 7.4.6.2, 7.4.7.1, 7.4.7.2, 7.5.0.1, 7.5.0.2, 7.5.0.3, 7.5.1.1, 7.5.1.2, 7.5.2.1, 7.5.2.2, 7.5.3.1, 7.5.3.2, 7.5.4.1, 7.5.4.2, 7.5.5.1, 7.5.5.2, 7.5.6.1, 7.5.6.2, 7.5.7.1, 7.5.8.1, 7.5.8.2, 7.6.0.1, 7.6.0.2, 7.6.0.3, 7.6.1.1, 7.6.1.2, 7.6.2.1
External links
https://www.libreoffice.org/about-us/security/advisories/cve-2023-6185
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
