wid-sec-w-2023-3097
Vulnerability from csaf_certbund
Published
2023-12-11 23:00
Modified
2024-06-16 22:00
Summary
LibreOffice: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
LibreOffice ist eine leistungsfähige Office-Suite, voll kompatibel mit den Programmen anderer großer Office-Anbieter, für verbreitete Betriebssysteme wie Windows, GNU/Linux und Apple Mac OS X geeignet. LibreOffice bietet sechs Anwendungen für die Erstellung von Dokumenten und zur Datenverarbeitung: Writer, Calc, Impress, Draw, Base und Math.
Angriff
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in LibreOffice ausnutzen, um beliebigen Programmcode auszuführen.
Betroffene Betriebssysteme
- Linux
- MacOS X
- Windows
{ document: { aggregate_severity: { text: "hoch", }, category: "csaf_base", csaf_version: "2.0", distribution: { tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "de-DE", notes: [ { category: "legal_disclaimer", text: "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.", }, { category: "description", text: "LibreOffice ist eine leistungsfähige Office-Suite, voll kompatibel mit den Programmen anderer großer Office-Anbieter, für verbreitete Betriebssysteme wie Windows, GNU/Linux und Apple Mac OS X geeignet. LibreOffice bietet sechs Anwendungen für die Erstellung von Dokumenten und zur Datenverarbeitung: Writer, Calc, Impress, Draw, Base und Math.", title: "Produktbeschreibung", }, { category: "summary", text: "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in LibreOffice ausnutzen, um beliebigen Programmcode auszuführen.", title: "Angriff", }, { category: "general", text: "- Linux\n- MacOS X\n- Windows", title: "Betroffene Betriebssysteme", }, ], publisher: { category: "other", contact_details: "csaf-provider@cert-bund.de", name: "Bundesamt für Sicherheit in der Informationstechnik", namespace: "https://www.bsi.bund.de", }, references: [ { category: "self", summary: "WID-SEC-W-2023-3097 - CSAF Version", url: "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-3097.json", }, { category: "self", summary: "WID-SEC-2023-3097 - Portal Version", url: "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-3097", }, { category: "external", summary: "LibreOffice Security Advisory vom 2023-12-11", url: "https://www.libreoffice.org/about-us/security/advisories/cve-2023-6185/", }, { category: "external", summary: "LibreOffice Security Advisory vom 2023-12-11", url: "https://www.libreoffice.org/about-us/security/advisories/cve-2023-6186/", }, { category: "external", summary: "Debian Security Advisory vom 2023-12-11", url: "https://www.debian.org/security/2023/dsa-5574", }, { category: "external", summary: "Ubuntu Security Notice vom 2023-12-11", url: "https://ubuntu.com/security/notices/USN-6546-1", }, { category: "external", summary: "Ubuntu Security Notice USN-6546-2 vom 2023-12-14", url: "https://ubuntu.com/security/notices/USN-6546-2", }, { category: "external", summary: "SUSE Security Update SUSE-SU-2023:4932-1 vom 2023-12-20", url: "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017502.html", }, { category: "external", summary: "SUSE Security Update SUSE-SU-2023:4984-1 vom 2023-12-28", url: "https://lists.suse.com/pipermail/sle-security-updates/2023-December/017570.html", }, { category: "external", summary: "Debian Security Advisory DLA-3703 vom 2023-12-31", url: "https://lists.debian.org/debian-lts-announce/2023/12/msg00026.html", }, { category: "external", summary: "Gentoo Linux Security Advisory GLSA-202402-29 vom 2024-02-21", url: "https://security.gentoo.org/glsa/202402-29", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:1425 vom 2024-03-19", url: "https://access.redhat.com/errata/RHSA-2024:1425", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:1423 vom 2024-03-19", url: "https://access.redhat.com/errata/RHSA-2024:1423", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:1427 vom 2024-03-19", url: "https://access.redhat.com/errata/RHSA-2024:1427", }, { category: "external", summary: "Oracle Linux Security Advisory ELSA-2024-1427 vom 2024-03-20", url: "https://linux.oracle.com/errata/ELSA-2024-1427.html", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:1473 vom 2024-03-21", url: "https://access.redhat.com/errata/RHSA-2024:1473", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:1480 vom 2024-03-25", url: "https://access.redhat.com/errata/RHSA-2024:1480", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:1514 vom 2024-03-26", url: "https://access.redhat.com/errata/RHSA-2024:1514", }, { category: "external", summary: "Rocky Linux Security Advisory RLSA-2024:1514 vom 2024-03-27", url: "https://errata.build.resf.org/RLSA-2024:1514", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:1513 vom 2024-03-26", url: "https://access.redhat.com/errata/RHSA-2024:1513", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:1512 vom 2024-03-26", url: "https://access.redhat.com/errata/RHSA-2024:1512", }, { category: "external", summary: "Oracle Linux Security Advisory ELSA-2024-1514 vom 2024-03-29", url: "http://linux.oracle.com/errata/ELSA-2024-1514.html", }, { category: "external", summary: "Amazon Linux Security Advisory ALASLIBREOFFICE-2024-003 vom 2024-04-29", url: "https://alas.aws.amazon.com/AL2/ALASLIBREOFFICE-2024-003.html", }, { category: "external", summary: "Rocky Linux Security Advisory RLSA-2024:1427 vom 2024-05-10", url: "https://errata.build.resf.org/RLSA-2024:1427", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:3304 vom 2024-05-23", url: "https://access.redhat.com/errata/RHSA-2024:3304", }, { category: "external", summary: "Oracle Linux Security Advisory ELSA-2024-3304 vom 2024-05-24", url: "https://linux.oracle.com/errata/ELSA-2024-3304.html", }, { category: "external", summary: "Red Hat Security Advisory RHSA-2024:3835 vom 2024-06-11", url: "https://access.redhat.com/errata/RHSA-2024:3835", }, { category: "external", summary: "Oracle Linux Security Advisory ELSA-2024-3835 vom 2024-06-12", url: "https://linux.oracle.com/errata/ELSA-2024-3835.html", }, { category: "external", summary: "Rocky Linux Security Advisory RLSA-2024:3835 vom 2024-06-14", url: "https://errata.build.resf.org/RLSA-2024:3835", }, ], source_lang: "en-US", title: "LibreOffice: Mehrere Schwachstellen", tracking: { current_release_date: "2024-06-16T22:00:00.000+00:00", generator: { date: "2024-08-15T18:02:36.784+00:00", engine: { name: "BSI-WID", version: "1.3.5", }, }, id: "WID-SEC-W-2023-3097", initial_release_date: "2023-12-11T23:00:00.000+00:00", revision_history: [ { date: "2023-12-11T23:00:00.000+00:00", number: "1", summary: "Initiale Fassung", }, { date: "2023-12-14T23:00:00.000+00:00", number: "2", summary: "Neue Updates von Ubuntu aufgenommen", }, { date: "2023-12-20T23:00:00.000+00:00", number: "3", summary: "Neue Updates von SUSE aufgenommen", }, { date: "2023-12-28T23:00:00.000+00:00", number: "4", summary: "Neue Updates von SUSE aufgenommen", }, { date: "2024-01-01T23:00:00.000+00:00", number: "5", summary: "Neue Updates von Debian aufgenommen", }, { date: "2024-02-21T23:00:00.000+00:00", number: "6", summary: "Neue Updates von Gentoo aufgenommen", }, { date: "2024-03-19T23:00:00.000+00:00", number: "7", summary: "Neue Updates von Red Hat aufgenommen", }, { date: "2024-03-20T23:00:00.000+00:00", number: "8", summary: "Neue Updates von Oracle Linux aufgenommen", }, { date: "2024-03-21T23:00:00.000+00:00", number: "9", summary: "Neue Updates von Red Hat aufgenommen", }, { date: "2024-03-25T23:00:00.000+00:00", number: "10", summary: "Neue Updates von Red Hat aufgenommen", }, { date: "2024-03-26T23:00:00.000+00:00", number: "11", summary: "Neue Updates von Red Hat und Rocky Enterprise Software Foundation aufgenommen", }, { date: "2024-04-01T22:00:00.000+00:00", number: "12", summary: "Neue Updates von Oracle Linux aufgenommen", }, { date: "2024-04-29T22:00:00.000+00:00", number: "13", summary: "Neue Updates von Amazon aufgenommen", }, { date: "2024-05-12T22:00:00.000+00:00", number: "14", summary: "Neue Updates von Rocky Enterprise Software Foundation aufgenommen", }, { date: "2024-05-22T22:00:00.000+00:00", number: "15", summary: "Neue Updates von Red Hat aufgenommen", }, { date: "2024-05-26T22:00:00.000+00:00", number: "16", summary: "Neue Updates von Oracle Linux aufgenommen", }, { date: "2024-06-11T22:00:00.000+00:00", number: "17", summary: "Neue Updates von Red Hat aufgenommen", }, { date: "2024-06-12T22:00:00.000+00:00", number: "18", summary: "Neue Updates von Oracle Linux aufgenommen", }, { date: "2024-06-16T22:00:00.000+00:00", number: "19", summary: "Neue Updates von Rocky Enterprise Software Foundation aufgenommen", }, ], status: "final", version: "19", }, }, product_tree: { branches: [ { branches: [ { category: "product_name", name: "Amazon Linux 2", product: { name: "Amazon Linux 2", product_id: "398363", product_identification_helper: { cpe: "cpe:/o:amazon:linux_2:-", }, }, }, ], category: "vendor", name: "Amazon", }, { branches: [ { branches: [ { category: "product_name", name: "Debian Linux", product: { name: "Debian Linux", product_id: "2951", product_identification_helper: { cpe: "cpe:/o:debian:debian_linux:-", }, }, }, { category: "product_name", name: "Debian Linux", product: { name: "Debian Linux", product_id: "T028216", product_identification_helper: { cpe: "cpe:/o:debian:debian_linux:-", }, }, }, ], category: "product_name", name: "Linux", }, ], category: "vendor", name: "Debian", }, { branches: [ { category: "product_name", name: "Gentoo Linux", product: { name: "Gentoo Linux", product_id: "T012167", product_identification_helper: { cpe: "cpe:/o:gentoo:linux:-", }, }, }, ], category: "vendor", name: "Gentoo", }, { branches: [ { branches: [ { category: "product_version_range", name: "<7.6.3", product: { name: "Open Source LibreOffice <7.6.3", product_id: "T031557", }, }, { category: "product_version_range", name: "<7.5.9", product: { name: "Open Source LibreOffice <7.5.9", product_id: "T031558", }, }, { category: "product_version_range", name: "<7.6.4", product: { name: "Open Source LibreOffice <7.6.4", product_id: "T031559", }, }, ], category: "product_name", name: "LibreOffice", }, ], category: "vendor", name: "Open Source", }, { branches: [ { category: "product_name", name: "Oracle Linux", product: { name: "Oracle Linux", product_id: "T004914", product_identification_helper: { cpe: "cpe:/o:oracle:linux:-", }, }, }, ], category: "vendor", name: "Oracle", }, { branches: [ { category: "product_name", name: "RESF Rocky Linux", product: { name: "RESF Rocky Linux", product_id: "T032255", product_identification_helper: { cpe: "cpe:/o:resf:rocky_linux:-", }, }, }, ], category: "vendor", name: "RESF", }, { branches: [ { category: "product_name", name: "Red Hat Enterprise Linux", product: { name: "Red Hat Enterprise Linux", product_id: "67646", product_identification_helper: { cpe: "cpe:/o:redhat:enterprise_linux:-", }, }, }, ], category: "vendor", name: "Red Hat", }, { branches: [ { category: "product_name", name: "SUSE Linux", product: { name: "SUSE Linux", product_id: "T002207", product_identification_helper: { cpe: "cpe:/o:suse:suse_linux:-", }, }, }, ], category: "vendor", name: "SUSE", }, { branches: [ { branches: [ { category: "product_name", name: "Ubuntu Linux", product: { name: "Ubuntu Linux", product_id: "883326", product_identification_helper: { cpe: "cpe:/o:canonical:ubuntu_linux:-", }, }, }, { category: "product_name", name: "Ubuntu Linux", product: { name: "Ubuntu Linux", product_id: "T000126", product_identification_helper: { cpe: "cpe:/o:canonical:ubuntu_linux:-", }, }, }, ], category: "product_name", name: "Linux", }, ], category: "vendor", name: "Ubuntu", }, ], }, vulnerabilities: [ { cve: "CVE-2023-6185", notes: [ { category: "description", text: "Es besteht eine Schwachstelle in LibreOffice. Dieser Fehler besteht in der gstreamer-Komponente aufgrund einer unsachgemäßen Eingabevalidierung, die eine Pipeline-Injektion ermöglicht. Ein Angreifer kann diese Schwachstelle zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "2951", "T002207", "67646", "T000126", "883326", "398363", "T012167", "T028216", "T004914", "T032255", ], }, release_date: "2023-12-11T23:00:00.000+00:00", title: "CVE-2023-6185", }, { cve: "CVE-2023-6186", notes: [ { category: "description", text: "Es besteht eine Schwachstelle in LibreOffice. Dieser Fehler besteht aufgrund eines unzureichenden Schutzes gegen Makros in typischen gängigen Protokollen wie http/https-Hyperlinks. Ein Angreifer kann diese Schwachstelle zur Ausführung von beliebigem Code ausnutzen. Eine erfolgreiche Ausnutzung erfordert eine Benutzerinteraktion.", }, ], product_status: { known_affected: [ "2951", "T002207", "67646", "T000126", "883326", "398363", "T012167", "T028216", "T004914", "T032255", ], }, release_date: "2023-12-11T23:00:00.000+00:00", title: "CVE-2023-6186", }, ], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.