CVE-2023-6185high

CVE-2023-6185: high-severity vulnerability in The Document Foundation LibreOffice

Improper input validation enabling arbitrary Gstreamer pipeline injection

Published · Updated

Follow this CVE+ Monitor LibreOffice+ Monitor libreoffice

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.3epss 1.0%
Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugins. In affected versions the filename of the embedded video is not sufficiently escaped when passed to GStreamer enabling an attacker to run arbitrary gstreamer plugins depending on what plugins are installed on the target system.
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H
Affected products
The Document Foundation · LibreOffice
Related CVEs — The Document Foundation LibreOffice

In the same product, most dangerous first.

CVE-2022-3140—Macro URL arbitrary script executionEPSS 7.0%CVE-2021-25631—denylist of executable filename extensions possible to bypass under windowsEPSS 5.0%CVE-2023-2255—Remote documents loaded without prompt via IFrameEPSS 2.2%CVE-2020-12802—remote graphics contained in docx format retrieved in 'stealth mode'EPSS 2.0%CVE-2020-12803—XForms submissions could overwrite local filesEPSS 1.8%CVE-2022-26307—Weak Master KeysEPSS 1.5%