Lucene search

K
ubuntuUbuntuUSN-6144-1
HistoryJun 07, 2023 - 12:00 a.m.

LibreOffice vulnerabilities

2023-06-0700:00:00
ubuntu.com
31
libreoffice
vulnerabilities
array index underflow
iframe
ubuntu 22.04 lts
ubuntu 20.04 lts
information disclosure
arbitrary code
spreadsheet file
input file
cve-2023-0950
cve-2023-2255

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

34.2%

Releases

  • Ubuntu 22.04 LTS
  • Ubuntu 20.04 LTS

Packages

  • libreoffice - Office productivity suite

Details

It was discovered that LibreOffice did not properly validate the number of
parameters passed to the formula interpreter, leading to an array index
underflow attack. If a user were tricked into opening a specially crafted
spreadsheet file, an attacker could possibly use this issue to execute
arbitrary code. (CVE-2023-0950)

Amel Bouziane-Leblond discovered that LibreOffice did not prompt the user
before loading the host document inside an IFrame. If a user were tricked
into opening a specially crafted input file, an attacker could possibly use
this issue to cause information disclosure or execute arbitrary code.
(CVE-2023-2255)

OSVersionArchitecturePackageVersionFilename
Ubuntu22.04noarchlibreoffice< 1:7.3.7-0ubuntu0.22.04.3UNKNOWN
Ubuntu22.04noarchfonts-opensymbol< 2:102.12+LibO7.3.7-0ubuntu0.22.04.3UNKNOWN
Ubuntu22.04noarchgir1.2-lokdocview-0.1< 1:7.3.7-0ubuntu0.22.04.3UNKNOWN
Ubuntu22.04noarchlibjuh-java< 1:7.3.7-0ubuntu0.22.04.3UNKNOWN
Ubuntu22.04noarchlibjurt-java< 1:7.3.7-0ubuntu0.22.04.3UNKNOWN
Ubuntu22.04noarchliblibreoffice-java< 1:7.3.7-0ubuntu0.22.04.3UNKNOWN
Ubuntu22.04noarchliblibreofficekitgtk< 1:7.3.7-0ubuntu0.22.04.3UNKNOWN
Ubuntu22.04noarchliblibreofficekitgtk-dbgsym< 1:7.3.7-0ubuntu0.22.04.3UNKNOWN
Ubuntu22.04noarchlibofficebean-java< 1:7.3.7-0ubuntu0.22.04.3UNKNOWN
Ubuntu22.04noarchlibofficebean-java-dbgsym< 1:7.3.7-0ubuntu0.22.04.3UNKNOWN
Rows per page:
1-10 of 5101

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

0.001

Percentile

34.2%