Bugzilla – Bug 1212444
VUL-0: CVE-2023-1183: libreoffice: Arbitrary File Write in LibreOffice Base
Last modified: 2024-05-15 19:03:16 UTC
Public now: Gregor Kopf of Secfault Security GmbH discovered that HSQLDB, a Java SQL database engine, allowed the execution of spurious scripting commands in .script and .log files. Hsqldb supports a SCRIPT keyword which is normally used to record the commands input by the database admin to output such a script. In combination with LibreOffice, an attacker could craft an odb containing a "database/script" file which itself contained a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker.
SUSE-SU-2023:4496-1: An update that solves one vulnerability, contains three features and has two security fixes can now be installed. Category: security (moderate) Bug References: 1209243, 1212444, 1215595 CVE References: CVE-2023-1183 Jira References: PED-5199, PED-6799, PED-6800 Sources used: openSUSE Leap 15.4 (src): frozen-1.1.1-150400.9.3.2, liborcus-0.18.1-150400.13.3.2, mdds-2_1-2.1.1-150400.9.3.2, libreoffice-7.6.2.1-150400.17.17.3, libixion-0.18.1-150400.14.3.2 openSUSE Leap 15.5 (src): frozen-1.1.1-150400.9.3.2, liborcus-0.18.1-150400.13.3.2, mdds-2_1-2.1.1-150400.9.3.2, libreoffice-7.6.2.1-150400.17.17.3, libixion-0.18.1-150400.14.3.2 SUSE Package Hub 15 15-SP4 (src): frozen-1.1.1-150400.9.3.2, liborcus-0.18.1-150400.13.3.2, mdds-2_1-2.1.1-150400.9.3.2, libreoffice-7.6.2.1-150400.17.17.3, libixion-0.18.1-150400.14.3.2 SUSE Package Hub 15 15-SP5 (src): frozen-1.1.1-150400.9.3.2, liborcus-0.18.1-150400.13.3.2, mdds-2_1-2.1.1-150400.9.3.2, libreoffice-7.6.2.1-150400.17.17.3, libixion-0.18.1-150400.14.3.2 SUSE Linux Enterprise Workstation Extension 15 SP4 (src): liborcus-0.18.1-150400.13.3.2, libixion-0.18.1-150400.14.3.2, libreoffice-7.6.2.1-150400.17.17.3 SUSE Linux Enterprise Workstation Extension 15 SP5 (src): liborcus-0.18.1-150400.13.3.2, libixion-0.18.1-150400.14.3.2, libreoffice-7.6.2.1-150400.17.17.3 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4648-1: An update that solves one vulnerability, contains three features and has two security fixes can now be installed. Category: security (moderate) Bug References: 1209243, 1212444, 1215595 CVE References: CVE-2023-1183 Jira References: PED-5199, PED-6799, PED-6800 Sources used: SUSE Linux Enterprise Software Development Kit 12 SP5 (src): libetonyek-0.1.10-10.11.2, frozen-1.1.1-8.3.3, liborcus-0.18.1-18.3.3, mdds-2_1-2.1.1-8.3.3, libixion-0.18.1-21.3.3, libreoffice-7.6.2.1-48.47.6 SUSE Linux Enterprise Workstation Extension 12 12-SP5 (src): libetonyek-0.1.10-10.11.2, libreoffice-7.6.2.1-48.47.6, libixion-0.18.1-21.3.3, liborcus-0.18.1-18.3.3 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
done, closing