Read the docs
TI-2023-05681 Aliases CVE-2023-6186GHSA-q565-g228-cgg3

Link targets allow arbitrary script execution

Priority LOW 39CWE-281Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 19 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to execute built-in macros without warning. In affected versions LibreOffice supports hyperlinks with macro or similar built-in command targets that can be executed when activated without warning the user.

Why it matters now

EPSS 0.00772 55th percentileScored 2026-11-07
Fix Partial LibreOffice (The Document Foundation): 7.5.9, 7.6.4Red Hat: 9 advisoriesRed Hat: 19 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
The Document FoundationLibreOffice7.5 to before 7.5.9; 7.6 to before 7.6.47.5.9, 7.6.4Patch availableCNA
  • LibreOffice VendorThe Document Foundation Affected 7.5 to before 7.5.9; 7.6 to before 7.6.4 Fixed in 7.5.9, 7.6.4 Patch available CNA

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*7.5.0 to before 7.5.9; 7.6.0 to before 7.6.4VulnerableThe Document Foundation
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*38VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*12.0VulnerableDebian
  • cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:* Versions 7.5.0 to before 7.5.9; 7.6.0 to before 7.6.4 Vulnerable ·The Document Foundation
  • cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Debian

Remediation

  • Fix · CNA LibreOffice (The Document Foundation) Fixed in 7.5.9, 7.6.4

Red Hat 9 advisories

  • RHSA-2024:3835 Released 2024-06-11 · Red Hat rating Important
    libreoffice security update
    • Red Hat Enterprise Linux AppStream (v. 9) autocorr-af-1:7.1.8.1-12.el9_4, autocorr-bg-1:7.1.8.1-12.el9_4, autocorr-ca-1:7.1.8.1-12.el9_4 +47
    • Red Hat Enterprise Linux CRB (v. 9) libreoffice-sdk-1:7.1.8.1-12.el9_4, libreoffice-sdk-doc-1:7.1.8.1-12.el9_4
  • RHSA-2024:1514 Released 2024-03-26 · Red Hat rating Important
    libreoffice security fix update
    • Red Hat CodeReady Linux Builder (v. 8) libreoffice-sdk-1:6.4.7.2-16.el8_9, libreoffice-sdk-doc-1:6.4.7.2-16.el8_9
    • Red Hat Enterprise Linux AppStream (v. 8) autocorr-af-1:6.4.7.2-16.el8_9, autocorr-bg-1:6.4.7.2-16.el8_9, autocorr-ca-1:6.4.7.2-16.el8_9 +47
  • RHSA-2024:1513 Released 2024-03-26 · Red Hat rating Important
    libreoffice security fix update
    • Red Hat CodeReady Linux Builder EUS (v.8.8) libreoffice-sdk-1:6.4.7.2-16.el8_8, libreoffice-sdk-doc-1:6.4.7.2-16.el8_8
    • Red Hat Enterprise Linux AppStream EUS (v.8.8) autocorr-af-1:6.4.7.2-16.el8_8, autocorr-bg-1:6.4.7.2-16.el8_8, autocorr-ca-1:6.4.7.2-16.el8_8 +47
Show 6 more Red Hat advisories
  • RHSA-2024:1512 Released 2024-03-26 · Red Hat rating Important
    libreoffice security fix update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) autocorr-af-1:6.0.6.1-21.el8_2, autocorr-bg-1:6.0.6.1-21.el8_2, autocorr-ca-1:6.0.6.1-21.el8_2 +47
    • Red Hat Enterprise Linux AppStream E4S (v. 8.2) autocorr-af-1:6.0.6.1-21.el8_2, autocorr-bg-1:6.0.6.1-21.el8_2, autocorr-ca-1:6.0.6.1-21.el8_2 +47
    • Red Hat Enterprise Linux AppStream TUS (v. 8.2) autocorr-af-1:6.0.6.1-21.el8_2, autocorr-bg-1:6.0.6.1-21.el8_2, autocorr-ca-1:6.0.6.1-21.el8_2 +47
  • RHSA-2024:1480 Released 2024-03-25 · Red Hat rating Important
    libreoffice security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) autocorr-af-1:6.4.7.2-16.el8_4, autocorr-bg-1:6.4.7.2-16.el8_4, autocorr-ca-1:6.4.7.2-16.el8_4 +47
    • Red Hat Enterprise Linux AppStream E4S (v.8.4) autocorr-af-1:6.4.7.2-16.el8_4, autocorr-bg-1:6.4.7.2-16.el8_4, autocorr-ca-1:6.4.7.2-16.el8_4 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.4) autocorr-af-1:6.4.7.2-16.el8_4, autocorr-bg-1:6.4.7.2-16.el8_4, autocorr-ca-1:6.4.7.2-16.el8_4 +47
  • RHSA-2024:1473 Released 2024-03-21 · Red Hat rating Important
    libreoffice security update
    • Red Hat CodeReady Linux Builder EUS (v.8.6) libreoffice-sdk-1:6.4.7.2-16.el8_6, libreoffice-sdk-doc-1:6.4.7.2-16.el8_6
    • Red Hat Enterprise Linux AppStream EUS (v.8.6) autocorr-af-1:6.4.7.2-16.el8_6, autocorr-bg-1:6.4.7.2-16.el8_6, autocorr-ca-1:6.4.7.2-16.el8_6 +47
  • RHSA-2024:1427 Released 2024-03-19 · Red Hat rating Important
    libreoffice security update
    • Red Hat CodeReady Linux Builder (v. 9) libreoffice-sdk-1:7.1.8.1-12.el9_3, libreoffice-sdk-doc-1:7.1.8.1-12.el9_3
    • Red Hat Enterprise Linux AppStream (v. 9) autocorr-af-1:7.1.8.1-12.el9_3, autocorr-bg-1:7.1.8.1-12.el9_3, autocorr-ca-1:7.1.8.1-12.el9_3 +47
  • RHSA-2024:1425 Released 2024-03-19 · Red Hat rating Important
    libreoffice security update
    • Red Hat CodeReady Linux Builder EUS (v.9.2) libreoffice-sdk-1:7.1.8.1-12.el9_2, libreoffice-sdk-doc-1:7.1.8.1-12.el9_2
    • Red Hat Enterprise Linux AppStream EUS (v.9.2) autocorr-af-1:7.1.8.1-12.el9_2, autocorr-bg-1:7.1.8.1-12.el9_2, autocorr-ca-1:7.1.8.1-12.el9_2 +47
  • RHSA-2024:1423 Released 2024-03-19 · Red Hat rating Important
    libreoffice security update
    • Red Hat CodeReady Linux Builder EUS (v.9.0) libreoffice-sdk-1:7.1.8.1-12.el9_0, libreoffice-sdk-doc-1:7.1.8.1-12.el9_0
    • Red Hat Enterprise Linux AppStream EUS (v.9.0) autocorr-af-1:7.1.8.1-12.el9_0, autocorr-bg-1:7.1.8.1-12.el9_0, autocorr-ca-1:7.1.8.1-12.el9_0 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat CodeReady Linux Builder (v. 8)Fixed RHSA-2024:1514
Red Hat CodeReady Linux Builder (v. 9)Fixed RHSA-2024:1427
Red Hat CodeReady Linux Builder EUS (v.8.6)Fixed RHSA-2024:1473
Red Hat CodeReady Linux Builder EUS (v.8.8)Fixed RHSA-2024:1513
Red Hat CodeReady Linux Builder EUS (v.9.0)Fixed RHSA-2024:1423
Red Hat CodeReady Linux Builder EUS (v.9.2)Fixed RHSA-2024:1425
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:1514
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:1427, RHSA-2024:3835
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2024:1512
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2024:1480
Red Hat Enterprise Linux AppStream E4S (v. 8.2)Fixed RHSA-2024:1512
Red Hat Enterprise Linux AppStream E4S (v.8.4)Fixed RHSA-2024:1480
Red Hat Enterprise Linux AppStream EUS (v.8.6)Fixed RHSA-2024:1473
Red Hat Enterprise Linux AppStream EUS (v.8.8)Fixed RHSA-2024:1513
Red Hat Enterprise Linux AppStream EUS (v.9.0)Fixed RHSA-2024:1423
Red Hat Enterprise Linux AppStream EUS (v.9.2)Fixed RHSA-2024:1425
Red Hat Enterprise Linux AppStream TUS (v. 8.2)Fixed RHSA-2024:1512
Red Hat Enterprise Linux AppStream TUS (v.8.4)Fixed RHSA-2024:1480
Red Hat Enterprise Linux CRB (v. 9)Fixed RHSA-2024:3835
Not affected: 2 products
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-6186
  2. 2026-10-03 Alias added: GHSA-q565-g228-cgg3

References

Advisory 3

Other 1

  • TI-2019-07233 LibreLogo global-event script execution CVSS 3.1CRITICAL 9.8
  • TI-2018-12068 Path traversal in [UNKNOWN] libreoffice CVSS 3.0CRITICAL 9.8
  • TI-2018-07474 An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache… CVSS 3.0HIGH 7.5
  • TI-2019-07230 Code injection in Document Foundation LibreOffice CVSS 3.1CRITICAL 9.8
  • TI-2018-05018 LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary… CVSS 3.0CRITICAL 9.8
  • TI-2023-01118 Arbitrary file write in libreoffice CVSS 3.1MEDIUM 5.5
See all 70 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences