Information about two vulnerabilities in the free office suite LibreOffice has been revealed, assigned a high danger level (8.3 out of 10). The issues have been resolved in recent updates LibreOffice 7.6.4 and 7.5.9.
The first vulnerability (CVE-2023-6186) allows the execution of arbitrary scripts when a user clicks on a specially added link in the document, triggering built-in macros or internal commands. In certain situations, it was possible to disable the display of a preliminary warning about the operation being performed when clicking on such links.
The second vulnerability (CVE-2023-6185) allows arbitrary plugins to be executed in the Gstreamer multimedia framework on the Linux platform when opening a document with specially formatted embedded video. This issue is caused by the lack of proper escaping of special characters in the video file name before calling Gstreamer.
KĂ€lla: opennet.ru
