Cloudanix VulnDB

CVE-2023-6185

High · 8.8

CVSS

8.8

EPSS

1.0%

Published

Dec 11, 2023

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in how LibreOffice handles video files inside documents could let attackers run unwanted programs on a computer simply by tricking someone into opening a specially made file.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
Application
Class
Command Injection
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Improper input validation in LibreOffice's GStreamer integration allows an attacker-supplied video filename to execute arbitrary GStreamer plugins present on the system when the document is opened.

Why it matters to the business

Attackers can achieve code execution on user workstations that process untrusted documents, enabling data theft, ransomware deployment, or further network compromise with minimal user interaction.

How an attack unfolds

An attacker embeds a video object whose filename contains characters that cause GStreamer to load and run a chosen plugin; when a victim opens the document in an affected LibreOffice build, the unsanitized filename is passed directly to GStreamer, resulting in plugin execution.

How to fix it

Upgrade LibreOffice to a version that properly escapes video filenames before invoking GStreamer; until patches are available, disable GStreamer integration or restrict opening of documents from untrusted sources.

How to confirm the fix worked

Confirm the installed LibreOffice build contains the input-validation fix, then attempt to open a test document containing a video filename that previously triggered plugin execution and verify no unexpected plugin activity occurs.

Typical attack path

  1. Create a LibreOffice document containing an embedded video with a crafted filename
  2. Host or deliver the document via email, download, or shared storage
  3. Victim opens the document in LibreOffice
  4. LibreOffice invokes GStreamer with the unsanitized filename
  5. Arbitrary GStreamer plugin executes with the privileges of the LibreOffice process

How to detect it

Review LibreOffice and system logs for GStreamer invocations that reference unexpected plugin names or filenames containing shell metacharacters; correlate with document open events on endpoints.

  • gstreamer.*plugin.*exec
  • libreoffice.*video.*filename
  • unexpected gst-plugin load

What your security team should do

  • Prioritize deployment of the GStreamer filename-escaping fix across all LibreOffice installations
  • Configure application allow-listing or sandboxing to limit GStreamer plugin loading
  • Educate users to avoid opening documents from unknown sources until patches are applied
  • Monitor endpoint logs for unexpected GStreamer plugin loads initiated by LibreOffice

The record

Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugins. In affected versions the filename of the embedded video is not sufficiently escaped when passed to GStreamer enabling an attacker to run arbitrary gstreamer plugins depending on what plugins are installed on the target system.

Affected packages

Ecosystem Package Introduced Fixed
AlmaLinux:8 autocorr-af 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-bg 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-ca 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-cs 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-da 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-de 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-en 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-es 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-fa 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-fi 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-fr 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-ga 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-hr 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-hu 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-is 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-it 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-ja 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-ko 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-lb 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-lt 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-mn 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-nl 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-pl 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-pt 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-ro 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-ru 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-sk 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-sl 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-sr 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-sv 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-tr 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-vi 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 autocorr-zh 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-base 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-calc 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-core 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-data 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-draw 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-emailmerge 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-filters 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-gdb-debug-support 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-graphicfilter 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-gtk3 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-ar 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-bg 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-bn 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-ca 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-cs 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-da 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-de 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-dz 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-el 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-en 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-es 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-et 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-eu 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-fi 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-fr 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-gl 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-gu 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-he 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-hi 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-hr 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-hu 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-id 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-it 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-ja 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-ko 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-lt 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-lv 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-nb 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-nl 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-nn 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-pl 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-pt-BR 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-pt-PT 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-ro 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-ru 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-si 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-sk 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-sl 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-sv 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-ta 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-tr 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-uk 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-zh-Hans 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-help-zh-Hant 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-impress 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-af 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-ar 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-as 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-bg 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-bn 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-br 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-ca 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-cs 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-cy 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-da 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-de 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-dz 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-el 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-en 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-es 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-et 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-eu 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-fa 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-fi 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-fr 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-ga 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-gl 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-gu 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-he 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-hi 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-hr 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-hu 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-id 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-it 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-ja 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-kk 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-kn 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-ko 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-lt 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-lv 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-mai 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-ml 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-mr 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-nb 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-nl 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-nn 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-nr 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-nso 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-or 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-pa 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-pl 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-pt-BR 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-pt-PT 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-ro 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-ru 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-si 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-sk 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-sl 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-sr 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-ss 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-st 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-sv 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-ta 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-te 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-th 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-tn 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-tr 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-ts 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-uk 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-ve 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-xh 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-zh-Hans 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-zh-Hant 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-langpack-zu 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-math 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-ogltrans 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-opensymbol-fonts 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-pdfimport 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-pyuno 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-sdk 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-sdk-doc 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-ure 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-ure-common 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-wiki-publisher 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-writer 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-x11 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreoffice-xsltfilter 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:8 libreofficekit 0 1:6.4.7.2-16.el8_9.alma.1
AlmaLinux:9 autocorr-af 0 1:7.1.8.1-12.el9_4.alma.1
AlmaLinux:9 autocorr-af 0 1:7.1.8.1-12.el9_3.alma
AlmaLinux:9 autocorr-bg 0 1:7.1.8.1-12.el9_4.alma.1
AlmaLinux:9 autocorr-bg 0 1:7.1.8.1-12.el9_3.alma
AlmaLinux:9 autocorr-ca 0 1:7.1.8.1-12.el9_4.alma.1
AlmaLinux:9 autocorr-ca 0 1:7.1.8.1-12.el9_3.alma
AlmaLinux:9 autocorr-cs 0 1:7.1.8.1-12.el9_4.alma.1
AlmaLinux:9 autocorr-cs 0 1:7.1.8.1-12.el9_3.alma
AlmaLinux:9 autocorr-da 0 1:7.1.8.1-12.el9_4.alma.1
AlmaLinux:9 autocorr-da 0 1:7.1.8.1-12.el9_3.alma
AlmaLinux:9 autocorr-de 0 1:7.1.8.1-12.el9_4.alma.1
AlmaLinux:9 autocorr-de 0 1:7.1.8.1-12.el9_3.alma
AlmaLinux:9 autocorr-dsb 0 1:7.1.8.1-12.el9_4.alma.1
AlmaLinux:9 autocorr-dsb 0 1:7.1.8.1-12.el9_3.alma
AlmaLinux:9 autocorr-el 0 1:7.1.8.1-12.el9_4.alma.1
AlmaLinux:9 autocorr-el 0 1:7.1.8.1-12.el9_3.alma
AlmaLinux:9 autocorr-en 0 1:7.1.8.1-12.el9_4.alma.1
AlmaLinux:9 autocorr-en 0 1:7.1.8.1-12.el9_3.alma
AlmaLinux:9 autocorr-es 0 1:7.1.8.1-12.el9_4.alma.1
AlmaLinux:9 autocorr-es 0 1:7.1.8.1-12.el9_3.alma
AlmaLinux:9 autocorr-fa 0 1:7.1.8.1-12.el9_4.alma.1
AlmaLinux:9 autocorr-fa 0 1:7.1.8.1-12.el9_3.alma
AlmaLinux:9 autocorr-fi 0 1:7.1.8.1-12.el9_4.alma.1
AlmaLinux:9 autocorr-fi 0 1:7.1.8.1-12.el9_3.alma
AlmaLinux:9 autocorr-fr 0 1:7.1.8.1-12.el9_4.alma.1
AlmaLinux:9 autocorr-fr 0 1:7.1.8.1-12.el9_3.alma
AlmaLinux:9 autocorr-ga 0 1:7.1.8.1-12.el9_4.alma.1
AlmaLinux:9 autocorr-ga 0 1:7.1.8.1-12.el9_3.alma

Related vulnerabilities