CVE-2023-6185
Last modified
CVE-2023-6185 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugins. In affected versions the filename of the embedded video is not sufficiently escaped when passed to GStreamer enabling an attacker to run arbitrary gstreamer plugins depending on what plugins are installed on the target system.. EPSS estimates a 1.02% chance of exploitation in the next 30 days.
Description
Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugins. In affected versions the filename of the embedded video is not sufficiently escaped when passed to GStreamer enabling an attacker to run arbitrary gstreamer plugins depending on what plugins are installed on the target system.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Libreoffice | Libreoffice | >= 7.5.0, < 7.5.9 |
| Libreoffice | Libreoffice | >= 7.6.0, < 7.6.3 |
| Fedoraproject | Fedora | 38 |
| Debian | Debian Linux | 11.0 |
| Debian | Debian Linux | 12.0 |
References
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QB7UB6CTWQUDOE657OVVRSDYUY3IPBJG/Mailing List, Third Party Advisory
- https://www.debian.org/security/2023/dsa-5574Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QB7UB6CTWQUDOE657OVVRSDYUY3IPBJG/Mailing List, Third Party Advisory
- https://www.debian.org/security/2023/dsa-5574Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-6185?
How severe is CVE-2023-6185?
How do I fix CVE-2023-6185?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-6176A null pointer dereference flaw was found in the Linux kerne…4.7
- CVE-2023-6178 An arbitrary file write vulnerability exists where an authe…6.5
- CVE-2023-6179Honeywell ProWatch, 4.5, including all Service Pack versions…7.8
- CVE-2023-6180The tokio-boring library in version 4.0.0 is affected by a m…5.3
- CVE-2023-6181An oversight in BCB handling of reboot reason that allows fo…9.8
- CVE-2023-6184Cross SiteScripting vulnerability in Citrix Session Recordin…7.2
- CVE-2023-6186Insufficient macro permission validation of The Document Fou…8.8
- CVE-2023-6187The Paid Memberships Pro plugin for WordPress is vulnerable …8.8
- CVE-2023-6188A vulnerability was found in GetSimpleCMS 3.3.16/3.4.0a. It …9.8
- CVE-2023-6189Missing access permissions checks in the M-Files server be…5.3
- CVE-2023-6190Improper Limitation of a Pathname to a Restricted Directory …9.8
- CVE-2023-6191Improper Neutralization of Special Elements used in an SQL C…9.8
Are you affected by CVE-2023-6185?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST