CVE-2023-6186: 
NixOS vulnerability analysis and mitigation

CVE-2023-6186 is a security vulnerability discovered in The Document Foundation LibreOffice that allows attackers to execute built-in macros without warning. The vulnerability was disclosed on December 11, 2023, affecting LibreOffice versions 7.5.0 through 7.5.9 and 7.6.0 through 7.6.4. The issue stems from insufficient macro permission validation where hyperlinks with macro or similar built-in command targets can be executed when activated without warning the user (LibreOffice Advisory, NVD).

The vulnerability exists in LibreOffice's hyperlink functionality. While LibreOffice supports common protocols like http/https, it also allows hyperlinks to have target URLs that can launch built-in macros or dispatch built-in internal commands. In affected versions, these non-typical hyperlinks could be executed without proper warning when activated by users. The vulnerability received a CVSS v3.1 base score of 8.8 (High) from NIST and 8.3 (High) from The Document Foundation (NVD).

The vulnerability could allow an attacker to execute arbitrary built-in macros without warning when a user activates a malicious hyperlink in a document. This could potentially lead to unauthorized command execution within the context of LibreOffice's built-in functionality (LibreOffice Advisory).

The vulnerability has been fixed in LibreOffice versions 7.5.9 and 7.6.4. In the patched versions, the user's explicit macro execution permissions for the document are consulted before executing non-typical hyperlinks, and the ability to use these variants of hyperlink targets for floating frames has been removed. Users are recommended to upgrade to these versions or later to mitigate the vulnerability (LibreOffice Advisory, Debian Advisory).

Multiple Linux distributions have released security advisories and patches for this vulnerability, including Debian, Ubuntu, and Fedora. The vulnerability was discovered and reported by Reginaldo Silva of ubercomp.com, with Collabora Productivity providing the fix (Debian Advisory, LibreOffice Advisory).