Read the docs
TI-2023-05680 Aliases CVE-2023-6185GHSA-58qf-gq3r-xwgx

Improper input validation enabling arbitrary Gstreamer pipeline injection

Priority MEDIUM 42Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 24 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice allows an attacker to execute arbitrary GStreamer plugins. In affected versions the filename of the embedded video is not sufficiently escaped when passed to GStreamer enabling an attacker to run arbitrary gstreamer plugins depending on what plugins are installed on the target system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01017 63rd percentileScored 2026-11-07
Fix Partial LibreOffice (The Document Foundation): 7.5.9, 7.6.3Red Hat: 10 advisoriesRed Hat: 24 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
The Document FoundationLibreOffice7.5 to before 7.5.9; 7.6 to before 7.6.37.5.9, 7.6.3Patch availableCNA
  • LibreOffice VendorThe Document Foundation Affected 7.5 to before 7.5.9; 7.6 to before 7.6.3 Fixed in 7.5.9, 7.6.3 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*7.5.0 to before 7.5.9; 7.6.0 to before 7.6.3VulnerableThe Document Foundation
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*38VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*12.0VulnerableDebian
  • cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:* Versions 7.5.0 to before 7.5.9; 7.6.0 to before 7.6.3 Vulnerable ·The Document Foundation
  • cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Debian

Remediation

  • Fix · CNA LibreOffice (The Document Foundation) Fixed in 7.5.9, 7.6.3

Red Hat 10 advisories

  • RHSA-2024:3835 Released 2024-06-11 · Red Hat rating Important
    libreoffice security update
    • Red Hat Enterprise Linux AppStream (v. 9) autocorr-af-1:7.1.8.1-12.el9_4, autocorr-bg-1:7.1.8.1-12.el9_4, autocorr-ca-1:7.1.8.1-12.el9_4 +47
    • Red Hat Enterprise Linux CRB (v. 9) libreoffice-sdk-1:7.1.8.1-12.el9_4, libreoffice-sdk-doc-1:7.1.8.1-12.el9_4
  • RHSA-2024:3304 Released 2024-05-23 · Red Hat rating Important
    libreoffice security fix update
    • Red Hat Enterprise Linux Client (v. 7) autocorr-af-1:5.3.6.1-26.el7_9, autocorr-bg-1:5.3.6.1-26.el7_9, autocorr-ca-1:5.3.6.1-26.el7_9 +47
    • Red Hat Enterprise Linux Client Optional (v. 7) libreoffice-1:5.3.6.1-26.el7_9, libreoffice-bsh-1:5.3.6.1-26.el7_9, libreoffice-gdb-debug-support-1:5.3.6.1-26.el7_9 +47
    • Red Hat Enterprise Linux Server Optional (v. 7) autocorr-af-1:5.3.6.1-26.el7_9, autocorr-bg-1:5.3.6.1-26.el7_9, autocorr-ca-1:5.3.6.1-26.el7_9 +47
    • Red Hat Enterprise Linux Workstation (v. 7) autocorr-af-1:5.3.6.1-26.el7_9, autocorr-bg-1:5.3.6.1-26.el7_9, autocorr-ca-1:5.3.6.1-26.el7_9 +47
    • Red Hat Enterprise Linux Workstation Optional (v. 7) libreoffice-1:5.3.6.1-26.el7_9, libreoffice-bsh-1:5.3.6.1-26.el7_9, libreoffice-gdb-debug-support-1:5.3.6.1-26.el7_9 +47
  • RHSA-2024:1514 Released 2024-03-26 · Red Hat rating Important
    libreoffice security fix update
    • Red Hat CodeReady Linux Builder (v. 8) libreoffice-sdk-1:6.4.7.2-16.el8_9, libreoffice-sdk-doc-1:6.4.7.2-16.el8_9
    • Red Hat Enterprise Linux AppStream (v. 8) autocorr-af-1:6.4.7.2-16.el8_9, autocorr-bg-1:6.4.7.2-16.el8_9, autocorr-ca-1:6.4.7.2-16.el8_9 +47
Show 7 more Red Hat advisories
  • RHSA-2024:1513 Released 2024-03-26 · Red Hat rating Important
    libreoffice security fix update
    • Red Hat CodeReady Linux Builder EUS (v.8.8) libreoffice-sdk-1:6.4.7.2-16.el8_8, libreoffice-sdk-doc-1:6.4.7.2-16.el8_8
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) autocorr-af-1:6.4.7.2-16.el8_8, autocorr-bg-1:6.4.7.2-16.el8_8, autocorr-ca-1:6.4.7.2-16.el8_8 +47
  • RHSA-2024:1512 Released 2024-03-26 · Red Hat rating Important
    libreoffice security fix update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) autocorr-af-1:6.0.6.1-21.el8_2, autocorr-bg-1:6.0.6.1-21.el8_2, autocorr-ca-1:6.0.6.1-21.el8_2 +47
    • Red Hat Enterprise Linux AppStream E4S (v. 8.2) autocorr-af-1:6.0.6.1-21.el8_2, autocorr-bg-1:6.0.6.1-21.el8_2, autocorr-ca-1:6.0.6.1-21.el8_2 +47
    • Red Hat Enterprise Linux AppStream TUS (v. 8.2) autocorr-af-1:6.0.6.1-21.el8_2, autocorr-bg-1:6.0.6.1-21.el8_2, autocorr-ca-1:6.0.6.1-21.el8_2 +47
  • RHSA-2024:1480 Released 2024-03-25 · Red Hat rating Important
    libreoffice security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) autocorr-af-1:6.4.7.2-16.el8_4, autocorr-bg-1:6.4.7.2-16.el8_4, autocorr-ca-1:6.4.7.2-16.el8_4 +47
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) autocorr-af-1:6.4.7.2-16.el8_4, autocorr-bg-1:6.4.7.2-16.el8_4, autocorr-ca-1:6.4.7.2-16.el8_4 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) autocorr-af-1:6.4.7.2-16.el8_4, autocorr-bg-1:6.4.7.2-16.el8_4, autocorr-ca-1:6.4.7.2-16.el8_4 +47
  • RHSA-2024:1473 Released 2024-03-21 · Red Hat rating Important
    libreoffice security update
    • Red Hat CodeReady Linux Builder EUS (v.8.6) libreoffice-sdk-1:6.4.7.2-16.el8_6, libreoffice-sdk-doc-1:6.4.7.2-16.el8_6
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) autocorr-af-1:6.4.7.2-16.el8_6, autocorr-bg-1:6.4.7.2-16.el8_6, autocorr-ca-1:6.4.7.2-16.el8_6 +47
  • RHSA-2024:1427 Released 2024-03-19 · Red Hat rating Important
    libreoffice security update
    • Red Hat CodeReady Linux Builder (v. 9) libreoffice-sdk-1:7.1.8.1-12.el9_3, libreoffice-sdk-doc-1:7.1.8.1-12.el9_3
    • Red Hat Enterprise Linux AppStream (v. 9) autocorr-af-1:7.1.8.1-12.el9_3, autocorr-bg-1:7.1.8.1-12.el9_3, autocorr-ca-1:7.1.8.1-12.el9_3 +47
  • RHSA-2024:1425 Released 2024-03-19 · Red Hat rating Important
    libreoffice security update
    • Red Hat CodeReady Linux Builder EUS (v.9.2) libreoffice-sdk-1:7.1.8.1-12.el9_2, libreoffice-sdk-doc-1:7.1.8.1-12.el9_2
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) autocorr-af-1:7.1.8.1-12.el9_2, autocorr-bg-1:7.1.8.1-12.el9_2, autocorr-ca-1:7.1.8.1-12.el9_2 +47
  • RHSA-2024:1423 Released 2024-03-19 · Red Hat rating Important
    libreoffice security update
    • Red Hat CodeReady Linux Builder EUS (v.9.0) libreoffice-sdk-1:7.1.8.1-12.el9_0, libreoffice-sdk-doc-1:7.1.8.1-12.el9_0
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) autocorr-af-1:7.1.8.1-12.el9_0, autocorr-bg-1:7.1.8.1-12.el9_0, autocorr-ca-1:7.1.8.1-12.el9_0 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat CodeReady Linux Builder (v. 8)Fixed RHSA-2024:1514
Red Hat CodeReady Linux Builder (v. 9)Fixed RHSA-2024:1427
Red Hat CodeReady Linux Builder EUS (v.8.6)Fixed RHSA-2024:1473
Red Hat CodeReady Linux Builder EUS (v.8.8)Fixed RHSA-2024:1513
Red Hat CodeReady Linux Builder EUS (v.9.0)Fixed RHSA-2024:1423
Red Hat CodeReady Linux Builder EUS (v.9.2)Fixed RHSA-2024:1425
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:1514
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:1427, RHSA-2024:3835
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2024:1512
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2024:1480
Red Hat Enterprise Linux AppStream E4S (v. 8.2)Fixed RHSA-2024:1512
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2024:1480
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2024:1473
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:1513
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2024:1423
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:1425
Red Hat Enterprise Linux AppStream TUS (v. 8.2)Fixed RHSA-2024:1512
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2024:1480
Red Hat Enterprise Linux CRB (v. 9)Fixed RHSA-2024:3835
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2024:3304
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2024:3304
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2024:3304
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2024:3304
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2024:3304

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-6185
  2. 2026-10-03 Alias added: GHSA-58qf-gq3r-xwgx

References

Advisory 3

Other 1

  • TI-2019-07233 LibreLogo global-event script execution CVSS 3.1CRITICAL 9.8
  • TI-2018-12068 Path traversal in [UNKNOWN] libreoffice CVSS 3.0CRITICAL 9.8
  • TI-2018-07474 An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache… CVSS 3.0HIGH 7.5
  • TI-2019-07230 Code injection in Document Foundation LibreOffice CVSS 3.1CRITICAL 9.8
  • TI-2018-05018 LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary… CVSS 3.0CRITICAL 9.8
  • TI-2023-01118 Arbitrary file write in libreoffice CVSS 3.1MEDIUM 5.5
See all 70 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences