USN-6546-1: LibreOffice vulnerabilities

Releases

• Ubuntu 23.10
• Ubuntu 23.04

Packages

• libreoffice - Office productivity suite

Details

Reginaldo Silva discovered that LibreOffice incorrectly handled filenames
when passing embedded videos to GStreamer. If a user were tricked into
opening a specially crafted file, a remote attacker could possibly use this
issue to execute arbitrary GStreamer plugins. (CVE-2023-6185)

Reginaldo Silva discovered that LibreOffice incorrectly handled certain
non-typical hyperlinks. If a user were tricked into opening a specially
crafted file, a remote attacker could possibly use this issue to execute
arbitrary scripts. (CVE-2023-6186)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.10

• libreoffice - 4:7.6.4-0ubuntu0.23.10.1

Ubuntu 23.04

• libreoffice - 4:7.5.9-0ubuntu0.23.04.1

In general, a standard system update will make all the necessary changes.

References

• CVE-2023-6186
• CVE-2023-6185

Related notices

• USN-6546-2