tl;dr Upgrade to 7.5.9 or 7.6.4 ---
CVE-2023-6185: Improper input validation enabling arbitrary Gstreamer pipeline injection Fixed in: LibreOffice 7.5.9/7.6.3 Description: LibreOffice supports embedded videos in file formats via platform audio/video support. Typically under Linux this is via gstreamer. In affected version of LibreOffice the filename of the embedded video is not sufficiently escaped when passed to gstreamer enabling an attacker to run arbitrary gstreamer plugins depending on what plugins are installed on the target system. Linux Users are recommended to upgrade to 7.5.9 or 7.6.3 to avoid this flaw. --- CVE-2023-6186: Link targets allow arbitrary script execution Fixed in: LibreOffice 7.5.9/7.6.4 Description: LibreOffice supports hyperlinks. In addition to the typical common protocols such as http/https hyperlinks can also have target URLs that can launch built-in macros or dispatch built-in internal commands. In affected version of LibreOffice there are scenarios where these can be executed without warning if the user activates such hyperlinks. In later versions the users's explicit macro execution permissions for the document are now consulted if these non-typical hyperlinks can be executed. The possibility to use these variants of hyperlink targets for floating frames has been removed. Users are recommended to upgrade to 7.5.9 or 7.6.4 to avoid this flaw. --- Credit: Thanks to Reginaldo Silva of ubercomp.com for finding and reporting these issues. Thanks to Collabora Productivity for providing fixes. -- To unsubscribe e-mail to: discuss+unsubscr...@documentfoundation.org Problems? https://www.libreoffice.org/get-help/mailing-lists/how-to-unsubscribe/ Posting guidelines + more: https://wiki.documentfoundation.org/Netiquette List archive: https://listarchives.documentfoundation.org/www/discuss/ Privacy Policy: https://www.documentfoundation.org/privacy
