Lucene search

Document Fdn.CVE-2023-6185

HistoryDec 11, 2023 - 12:15 p.m.

CVE-2023-6185

2023-12-1112:15:07

Document Fdn.

web.nvd.nist.gov

cve-2023-6185

vulnerability

gstreamer

input validation

the document foundation

libreoffice

nvd

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.001

Percentile

28.5%

JSON

Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugins.

In affected versions the filename of the embedded video is not sufficiently escaped when passed to GStreamer enabling an attacker to run arbitrary gstreamer plugins depending on what plugins are installed on the target system.

Affected configurations

Nvd

Node

libreofficelibreofficeRange7.5.0–7.5.9

libreofficelibreofficeRange7.6.0–7.6.3

Node

fedoraprojectfedoraMatch38

Node

debiandebian_linuxMatch11.0

debiandebian_linuxMatch12.0

VendorProductVersionCPE
libreofficelibreoffice*cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*
fedoraprojectfedora38cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
debiandebian_linux11.0cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
debiandebian_linux12.0cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
libreoffice	libreoffice	*	cpe:2.3:a:libreoffice:libreoffice::::::::
fedoraproject	fedora	38	cpe:2.3:o:fedoraproject:fedora:38:::::::*
debian	debian_linux	11.0	cpe:2.3:o:debian:debian_linux:11.0:::::::*
debian	debian_linux	12.0	cpe:2.3:o:debian:debian_linux:12.0:::::::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "LibreOffice",
    "vendor": "The Document Foundation",
    "versions": [
      {
        "lessThan": "7.5.9",
        "status": "affected",
        "version": "7.5",
        "versionType": "7.5 series"
      },
      {
        "lessThan": "7.6.3",
        "status": "affected",
        "version": "7.6",
        "versionType": "7.6 series"
      }
    ]
  }
]