Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-6185

Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugins. In affected versions the filename of the embedded video is not sufficiently escaped when passed to GStreamer enabling an attacker to run arbitrary gstreamer plugins depending on what plugins are installed on the target system.

Published

2023-12-11T12:15:07.037

Last Modified

2025-02-13T18:16:06.290

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.3 (HIGH)

Weaknesses

Type: Primary
NVD-CWE-noinfo

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	libreoffice	libreoffice	< 7.5.9	Yes
Application	libreoffice	libreoffice	< 7.6.3	Yes
Operating System	fedoraproject	fedora	38	Yes
Operating System	debian	debian_linux	11.0	Yes
Operating System	debian	debian_linux	12.0	Yes

References

https://lists.debian.org/debian-lts-announce/2023/12/msg00026.html ([email protected])
https://lists.fedoraproject.org/archives/list/[email protected]/message/QB7UB6CTWQUDOE657OVVRSDYUY3IPBJG/ Mailing List, Third Party Advisory ([email protected])
https://www.debian.org/security/2023/dsa-5574 Third Party Advisory ([email protected])
https://www.libreoffice.org/about-us/security/advisories/cve-2023-6185 Vendor Advisory ([email protected])
https://lists.debian.org/debian-lts-announce/2023/12/msg00026.html (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/[email protected]/message/QB7UB6CTWQUDOE657OVVRSDYUY3IPBJG/ Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.debian.org/security/2023/dsa-5574 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.libreoffice.org/about-us/security/advisories/cve-2023-6185 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)