Arbitrary file write
Red Hat · Red Hat Enterprise Linux 6
A flaw in the LibreOffice package shipped with Red Hat Enterprise Linux 6 lets crafted .odb database files write attacker-chosen content to a new file at an attacker-determined location, due to improper input validation of the file's embedded "database/script" SCRIPT command. Exploitation requires a local attacker with low privileges and a user who must open the malicious file, and it results in arbitrary file writes that compromise integrity.
A flaw was found in the Libreoffice package. An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 10 Jul 2023. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.