CVE-2023-6186
Title: CVE-2023-6186: Link targets allow arbitrary script execution
Announced: December 11, 2023
Fixed in: LibreOffice 7.5.9/7.6.4
Description:
LibreOffice supports hyperlinks. In addition to the typical common protocols such as http/https hyperlinks can also have target URLs that can launch built-in macros or dispatch built-in internal commands. In affected version of LibreOffice there are scenarios where these can be executed without warning if the user activates such hyperlinks. In later versions the users's explicit macro execution permissions for the document are now consulted if these non-typical hyperlinks can be executed. The possibility to use these variants of hyperlink targets for floating frames has been removed.
Users are recommended to upgrade to 7.5.9 or 7.6.4 to avoid this flaw.
Credit:
Thanks to Reginaldo Silva of ubercomp.com for finding and reporting this issue.
Thanks to Collabora Productivity for providing a fix.
References:
Follow Us