CVE-2023-0950

Name	CVE-2023-0950
Description	Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow when loaded. In the affected versions of LibreOffice certain malformed spreadsheet formulas, such as AGGREGATE, could be created with less parameters passed to the formula interpreter than it expected, leading to an array index underflow, in which case there is a risk that arbitrary code could be executed. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.6; 7.5 versions prior to 7.5.1.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3526-1, DSA-5415-1, ELA-968-1, ELA-970-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libreoffice (PTS)	jessie, jessie (lts)	1:4.3.3-2+deb8u15	fixed
	stretch (security)	1:5.2.7-1+deb9u11	vulnerable
	stretch (lts), stretch	1:6.1.5-3+deb9u5	fixed
	buster, buster (lts)	1:6.1.5-3+deb10u14	fixed
	buster (security)	1:6.1.5-3+deb10u12	fixed
	bullseye	1:7.0.4-4+deb11u10	fixed
	bullseye (security)	1:7.0.4-4+deb11u11	fixed
	bookworm	4:7.4.7-1+deb12u4	fixed
	bookworm (security)	4:7.4.7-1+deb12u5	fixed
	sid, trixie	4:24.8.2-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
libreoffice	source	jessie	1:4.3.3-2+deb8u14	ELA-970-1
libreoffice	source	stretch	1:6.1.5-3~deb9u1	ELA-968-1
libreoffice	source	buster	1:6.1.5-3+deb10u10	DLA-3526-1
libreoffice	source	bullseye	1:7.0.4-4+deb11u7	DSA-5415-1
libreoffice	source	(unstable)	4:7.4.5-3

https://www.libreoffice.org/about-us/security/advisories/cve-2023-0950/