=====================================================================

                                 CERT-Renater

                      Note d'Information No. 2023/VULN523

_____________________________________________________________________

DATE                : 12/12/2023

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running LibreOffice versions prior to
                                       7.5.9, 7.6.4.

=====================================================================
https://www.libreoffice.org/about-us/security/advisories/cve-2023-6186/
https://www.libreoffice.org/about-us/security/advisories/cve-2023-6185/
_____________________________________________________________________


CVE-2023-6186

Title: CVE-2023-6186: Link targets allow arbitrary script execution

Announced: December 11, 2023

Fixed in: LibreOffice 7.5.9/7.6.4

Description:

LibreOffice supports hyperlinks. In addition to the typical common
protocols such as http/https hyperlinks can also have target URLs
that can launch built-in macros or dispatch built-in internal
commands. In affected version of LibreOffice there are scenarios
where these can be executed without warning if the user activates
such hyperlinks. In later versions the users's explicit macro
execution permissions for the document are now consulted if these
non-typical hyperlinks can be executed. The possibility to use
these variants of hyperlink targets for floating frames has been
removed.

Users are recommended to upgrade to 7.5.9 or 7.6.4 to avoid this
flaw.


Credit:

Thanks to Reginaldo Silva of ubercomp.com for finding and reporting
this issue.

Thanks to Collabora Productivity for providing a fix.


References:

     CVE-2023-6186

_____________________________________________________________________

CVE-2023-6185

Title: CVE-2023-6185: Improper input validation enabling arbitrary
Gstreamer pipeline injection

Announced: December 11, 2023

Fixed in: LibreOffice 7.5.9/7.6.3

Description:

LibreOffice supports embedded videos in file formats via platform
audio/video support. Typically under Linux this is via gstreamer.
In affected version of LibreOffice the filename of the embedded
video is not sufficiently escaped when passed to gstreamer
enabling an attacker to run arbitrary gstreamer plugins depending
on what plugins are installed on the target system.

Linux Users are recommended to upgrade to 7.5.9 or 7.6.3 to avoid
this flaw.


Credit:

Thanks to Reginaldo Silva of ubercomp.com for finding and reporting
this issue.

Thanks to Collabora Productivity for providing a fix.


References:

     CVE-2023-6185

=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================