UBUNTU-CVE-2023-0950

    Dashboard / Vulnerabilities / UBUNTU-CVE-2023-0950

    UBUNTU-CVE-2023-0950

    Published: 25 May 2023Last Modified: 22 Apr 2026
    Upstream:
    CVE-2023-0950
    Aliases:
    USN-6144-1

    Summary:

    Details: Improper Validation of Array Index vulnerability in the spreadsheet component of The Document Foundation LibreOffice allows an attacker to craft a spreadsheet document that will cause an array index underflow when loaded. In the affected versions of LibreOffice certain malformed spreadsheet formulas, such as AGGREGATE, could be created with less parameters passed to the formula interpreter than it expected, leading to an array index underflow, in which case there is a risk that arbitrary code could be executed. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.6; 7.5 versions prior to 7.5.1.

    References: https://ubuntu.com/security/CVE-2023-0950, https://www.libreoffice.org/about-us/security/advisories/CVE-2023-0950, https://ubuntu.com/security/notices/USN-6144-1, https://www.cve.org/CVERecord?id=CVE-2023-0950

    Affected packages

    Package

    Name: libreoffice

    Purl: pkg:deb/ubuntu/libreoffice@1:6.4.7-0ubuntu0.20.04.8?arch=source&distro=focal

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1:6.4.7-0ubuntu0.20.04.8

    Affected versions

    1:6.3.2-0ubuntu2
    1:6.3.3-0ubuntu1
    1:6.3.3-0ubuntu2
    1:6.3.4-0ubuntu1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2023-0950 | CVE-DB