The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1513 advisory.

    LibreOffice is an open source, community-developed office productivity suite. It includes key desktop     applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a     drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office     suite.

    Security Fix(es):

    * libreoffice: Improper Input Validation leading to arbitrary gstreamer plugin execution (CVE-2023-6185)

    * libreoffice: Insufficient macro permission validation leading to macro execution (CVE-2023-6186)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-1427 advisory.

    - Fix CVE-2023-6185 escape url passed to gstreamer

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1425 advisory.

    LibreOffice is an open source, community-developed office productivity suite. It includes key desktop     applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a     drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office     suite.

    Security Fix(es):

    * CVE-2023-6186 libreoffice: various flaws (JIRA:RHEL-20656)
    * CVE-2023-6185 libreoffice: various flaws (JIRA:RHEL-20656)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6546-2 advisory.

    USN-6546-1 fixed vulnerabilities in LibreOffice. This update provides the corresponding updates for Ubuntu     20.04 LTS and Ubuntu 22.04 LTS.



Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1480 advisory.

    LibreOffice is an open source, community-developed office productivity suite. It includes key desktop     applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a     drawing program. LibreOffice     replaces OpenOffice and provides a similar but enhanced and extended office     suite.

    Security Fix(es):

    * libreoffice: Improper Input Validation leading to arbitrary gstreamer plugin execution (CVE-2023-6185)

    * libreoffice: Insufficient macro permission validation leading to macro execution (CVE-2023-6186)

    For more details about the security issue(s), including the impact, a CVSS     score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References     section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202402-29 (LibreOffice: Multiple Vulnerabilities)

  - Improper Input Validation vulnerability in GStreamer integration of The Document Foundation LibreOffice     allows an attacker to execute arbitrary GStreamer plugins. In affected versions the filename of the     embedded video is not sufficiently escaped when passed to GStreamer enabling an attacker to run arbitrary     gstreamer plugins depending on what plugins are installed on the target system. (CVE-2023-6185)

  - Insufficient macro permission validation of The Document Foundation LibreOffice allows an attacker to     execute built-in macros without warning. In affected versions LibreOffice supports hyperlinks with macro     or similar built-in command targets that can be executed when activated without warning the user.
    (CVE-2023-6186)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-8408:04 advisory.

    * libreoffice: Improper Input Validation leading to arbitrary gstreamer plugin execution (CVE-2023-6185)
      * libreoffice: Insufficient macro permission validation leading to macro execution (CVE-2023-6186)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:3835 advisory.

    * libreoffice: Improper Input Validation leading to arbitrary gstreamer plugin execution (CVE-2023-6185)

    * libreoffice: Insufficient macro permission validation leading to macro execution (CVE-2023-6186)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1427 advisory.

    LibreOffice is an open source, community-developed office productivity suite. It includes key desktop     applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a     drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office     suite.

    Security Fix(es):

    * CVE-2023-6186 libreoffice: various flaws (JIRA:RHEL-20657)
    * CVE-2023-6185 libreoffice: various flaws (JIRA:RHEL-20657)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0096 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

    CVE-2023-6185:
    An improper input validation vulnerability was found in LibreOffice. In versions where filenames are not     sufficiently escaped, an attacker can execute arbitrary GStreamer plugins.

    CVE-2023-6186:
    An insufficient permission validation vulnerability was found in LibreOffice. In versions that support     running commands in hyperlinks, an attacker can execute built-in macros without warning the user.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1512 advisory.

    LibreOffice is an open source, community-developed office productivity suite. It includes key desktop     applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a     drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office     suite.

    Security Fix(es):

    * libreoffice: Improper Input Validation leading to arbitrary gstreamer plugin execution (CVE-2023-6185)

    * libreoffice: Insufficient macro permission validation leading to macro execution (CVE-2023-6186)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:3835 advisory.

    LibreOffice is an open source, community-developed office productivity suite. It includes key desktop     applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a     drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office     suite.

    Security Fix(es):

    * libreoffice: Improper Input Validation leading to arbitrary gstreamer plugin execution (CVE-2023-6185)

    * libreoffice: Insufficient macro permission validation leading to macro execution (CVE-2023-6186)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3703 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3703-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     December 31, 2023                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libreoffice     Version        : 1:6.1.5-3+deb10u11     CVE ID         : CVE-2020-12801 CVE-2020-12802 CVE-2020-12803 CVE-2023-6185                      CVE-2023-6186

    Multiple vulnerabilities have been discovered in LibreOffice an     office productivity software suite:

    CVE-2020-12801

        If LibreOffice has an encrypted document         open and crashes, that document is auto-saved encrypted.
        On restart, LibreOffice offers to restore the document         and prompts for the password to decrypt it. If the recovery         is successful, and if the file format of the recovered document         was not LibreOffice's default ODF file format, then affected versions         of LibreOffice default that subsequent saves of the document         are unencrypted. This may lead to a user accidentally saving         a MSOffice file format document unencrypted while believing         it to be encrypted.

    CVE-2020-12802

        LibreOffice has a 'stealth mode' in which only         documents from locations deemed 'trusted' are allowed to         retrieve remote resources. This mode is not the default mode,         but can be enabled by users who want to disable LibreOffice's ability         to include remote resources within a document. A flaw existed         where remote graphic links loaded from docx documents were omitted         from this protection.

    CVE-2020-12803

        ODF documents can contain forms to be         filled out by the user. Similar to HTML forms, the contained         form data can be submitted to a URI, for example, to an external         web server. To create submittable forms, ODF implements the         XForms W3C standard, which allows data to be submitted without         the need for macros or other active scripting. LibreOffice allowed         forms to be submitted to any URI, including file: URIs, enabling         form submissions to overwrite local files. User-interaction         is required to submit the form, but to avoid the possibility         of malicious documents engineered to maximize the possibility of         inadvertent user submission this feature has now been limited to         http[s] URIs, removing the possibility to overwrite local files.

    CVE-2023-6185

        An Improper Input Validation vulnerability         was found in GStreamer integration of The Document         Foundation LibreOffice allows an attacker to execute arbitrary         GStreamer plugins. In affected versions the filename of the         embedded video is not sufficiently escaped when passed to         GStreamer enabling an attacker to run arbitrary         gstreamer plugins depending on what plugins are installed         on the target system.

    CVE-2023-6186

        LibreOffice supports hyperlinks.
        In addition to the typical common protocols such as         http/https hyperlinks can also have target URLs that         can launch built-in macros or dispatch built-in         internal commands. In affected version of LibreOffice         there are scenarios where these can be executed without warning         if the user activates such hyperlinks. In later versions         the users's explicit macro execution permissions         for the document are now consulted if these non-typical         hyperlinks can be executed. The possibility to use these         variants of hyperlink targets for floating frames has been removed.

    For Debian 10 buster, these problems have been fixed in version     1:6.1.5-3+deb10u11.

    We recommend that you upgrade your libreoffice packages.

    For the detailed security status of libreoffice please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libreoffice

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

LibreOffice supports hyperlinks. In addition to the typical common protocols such as http/https hyperlinks can also have target URLs that can launch built-in macros or dispatch built-in internal commands. In affected version of LibreOffice there are scenarios where these can be executed without warning if the user activates such hyperlinks. In later versions the users's explicit macro execution permissions for the document are now consulted if these non-typical hyperlinks can be executed. The possibility to use these variants of hyperlink targets for floating frames has been removed.
This issue affects: The Document Foundation LibreOffice 7.5 versions prior to 7.5.9; 7.6 versions prior to 7.6.4.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-7635:01 advisory.

    * CVE-2023-6186 libreoffice: various flaws
      * CVE-2023-6185 libreoffice: various flaws

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-3835 advisory.

    - Fix CVE-2023-6185 escape url passed to gstreamer
    - Fix CVE-2023-6186 check link target protocols
    - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula       Parsing
    - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded       without prompt via IFrame
    - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write
    - Resolves: rhbz#2182392 CVE-2022-38745

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
192587	RHEL 8 : libreoffice (RHSA-2024:1513)	Nessus	Red Hat Local Security Checks	2024/3/26	2024/11/7	high
192314	Oracle Linux 9 : libreoffice (ELSA-2024-1427)	Nessus	Oracle Linux Local Security Checks	2024/3/20	2025/9/9	high
192283	RHEL 9 : libreoffice (RHSA-2024:1425)	Nessus	Red Hat Local Security Checks	2024/3/19	2024/11/8	high
186989	Ubuntu 20.04 LTS / 22.04 LTS : LibreOffice vulnerabilities (USN-6546-2)	Nessus	Ubuntu Local Security Checks	2023/12/15	2024/10/29	high
192557	RHEL 8 : libreoffice (RHSA-2024:1480)	Nessus	Red Hat Local Security Checks	2024/3/25	2024/11/8	high
190860	GLSA-202402-29 : LibreOffice: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	2024/2/21	2024/2/21	high
292468	MiracleLinux 9 : libreoffice-7.1.8.1-12.el9_4.ML.1 (AXSA:2024-8408:04)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
200616	Rocky Linux 9 : libreoffice (RLSA-2024:3835)	Nessus	Rocky Linux Local Security Checks	2024/6/14	2024/6/14	high
192285	RHEL 9 : libreoffice (RHSA-2024:1427)	Nessus	Red Hat Local Security Checks	2024/3/19	2024/11/7	high
239679	TencentOS Server 3: libreoffice (TSSA-2024:0096)	Nessus	Tencent Local Security Checks	2025/6/16	2025/11/20	high
192585	RHEL 8 : libreoffice (RHSA-2024:1512)	Nessus	Red Hat Local Security Checks	2024/3/26	2024/11/7	high
200424	RHEL 9 : libreoffice (RHSA-2024:3835)	Nessus	Red Hat Local Security Checks	2024/6/12	2026/3/3	high
214472	Debian dla-3703 : fonts-opensymbol - security update	Nessus	Debian Local Security Checks	2025/1/22	2025/1/22	high
186910	LibreOffice 7.5 < 7.5.9 / 7.6 < 7.6.4 Arbitrary Script Execution (macOS)	Nessus	MacOS X Local Security Checks	2023/12/14	2024/5/17	high
293303	MiracleLinux 9 : libreoffice-7.1.8.1-12.el9_3.ML.1 (AXSA:2024-7635:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	high
200443	Oracle Linux 9 : libreoffice (ELSA-2024-3835)	Nessus	Oracle Linux Local Security Checks	2024/6/12	2025/9/9	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high