CVE-2023-1183: Arbitrary file write
A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker.
Other sources
The issue occurs when LibreOffice executes the database/script file that is part of a base document. If this file contains a command like SCRIPT '../../../../../../../../../../../tmp/ohai', it will write the current contents of the database script to that file once a database connection is established.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/libreofficeto a version that resolves this vulnerability.Fixed in 7.4.6 - Upgrade
Upgrade
redhat/libreofficeto a version that resolves this vulnerability.Fixed in 7.5.1 - Upgrade
Upgrade
debian/hsqldbto a version that resolves this vulnerability.Fixed in 2.7.1-1+deb12u1Fixed in 2.7.4-1 - Upgrade
Upgrade
debian/hsqldb1.8.0to a version that resolves this vulnerability.Fixed in 1.8.0.10+dfsg-11+deb12u1Fixed in 1.8.0.10+dfsg-12.1+deb13u1Fixed in 1.8.0.10+dfsg2-2 - Upgrade
Upgrade
LibreOfficeto a version that resolves this vulnerability.Patch CVE-2023-1183
Event History
Frequently Asked Questions
What is the vulnerability ID of this flaw?
The vulnerability ID of this flaw is CVE-2023-1183.
What is the severity level of CVE-2023-1183?
CVE-2023-1183 has a severity level of 5.5 (medium).
How does CVE-2023-1183 affect Libreoffice?
CVE-2023-1183 affects Libreoffice versions 7.4.6 up to (but excluding) 7.5.1.
How can an attacker exploit CVE-2023-1183?
An attacker can exploit CVE-2023-1183 by crafting an odb file with a "database/script" file containing a SCRIPT command.
Are there any known remedies for CVE-2023-1183?
Yes, upgrading to Libreoffice version 7.5.1 or higher will fix the vulnerability.