CVE-2023-6185

Name	CVE-2023-6185
Description	Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugins. In affected versions the filename of the embedded video is not sufficiently escaped when passed to GStreamer enabling an attacker to run arbitrary gstreamer plugins depending on what plugins are installed on the target system.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3703-1, DSA-5574-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libreoffice (PTS)	buster	1:6.1.5-3+deb10u7	vulnerable
	buster (security)	1:6.1.5-3+deb10u11	fixed
	bullseye (security), bullseye	1:7.0.4-4+deb11u8	fixed
	bookworm, bookworm (security)	4:7.4.7-1+deb12u1	fixed
	trixie	4:24.2.0-1	fixed
	sid	4:24.2.3~rc1-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
libreoffice	source	buster	1:6.1.5-3+deb10u11	DLA-3703-1
libreoffice	source	bullseye	1:7.0.4-4+deb11u8	DSA-5574-1
libreoffice	source	bookworm	4:7.4.7-1+deb12u1	DSA-5574-1
libreoffice	source	(unstable)	4:7.6.3-1

https://www.libreoffice.org/about-us/security/advisories/cve-2023-6185/