CVE-2023-0950

Name	CVE-2023-0950
Description	Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow when loaded. In the affected versions of LibreOffice certain malformed spreadsheet formulas, such as AGGREGATE, could be created with less parameters passed to the formula interpreter than it expected, leading to an array index underflow, in which case there is a risk that arbitrary code could be executed. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.6; 7.5 versions prior to 7.5.1.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3526-1, DSA-5415-1, ELA-968-1, ELA-970-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
libreoffice (PTS)	jessie, jessie (lts)	1:4.3.3-2+deb8u15	fixed
	stretch (security)	1:5.2.7-1+deb9u11	vulnerable
	stretch (lts), stretch	1:6.1.5-3~deb9u2	fixed
	buster	1:6.1.5-3+deb10u7	vulnerable
	buster (security)	1:6.1.5-3+deb10u11	fixed
	bullseye	1:7.0.4-4+deb11u8	fixed
	bullseye (security)	1:7.0.4-4+deb11u9	fixed
	bookworm	4:7.4.7-1+deb12u1	fixed
	bookworm (security)	4:7.4.7-1+deb12u2	fixed
	sid, trixie	4:24.2.3-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
libreoffice	source	jessie	1:4.3.3-2+deb8u14	ELA-970-1
libreoffice	source	stretch	1:6.1.5-3~deb9u1	ELA-968-1
libreoffice	source	buster	1:6.1.5-3+deb10u10	DLA-3526-1
libreoffice	source	bullseye	1:7.0.4-4+deb11u7	DSA-5415-1
libreoffice	source	(unstable)	4:7.4.5-3

https://www.libreoffice.org/about-us/security/advisories/cve-2023-0950/