Test ID:	1.3.6.1.4.1.25623.1.1.1.2.2023.3467
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DLA-3467-1)
Summary:	The remote host is missing an update for the Debian 'hsqldb' package(s) announced via the DLA-3467-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'hsqldb' package(s) announced via the DLA-3467-1 advisory. Vulnerability Insight: Gregor Kopf of Secfault Security GmbH discovered that HSQLDB, a Java SQL database engine, allowed the execution of spurious scripting commands in .script and .log files. Hsqldb supports a SCRIPT keyword which is normally used to record the commands input by the database admin to output such a script. In combination with LibreOffice, an attacker could craft an odb containing a 'database/script' file which itself contained a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker. For Debian 10 buster, this problem has been fixed in version 2.4.1-2+deb10u2. We recommend that you upgrade your hsqldb packages. For the detailed security status of hsqldb please refer to its security tracker page at: [link moved to references] Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: [link moved to references] Affected Software/OS: 'hsqldb' package(s) on Debian 10. Solution: Please install the updated package(s). CVSS Score: 4.9 CVSS Vector: AV:L/AC:L/Au:N/C:N/I:C/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-1183 RHBZ#2208506 https://bugzilla.redhat.com/show_bug.cgi?id=2208506 https://access.redhat.com/security/cve/CVE-2023-1183 https://www.libreoffice.org/about-us/security/advisories/cve-2023-1183/ http://www.openwall.com/lists/oss-security/2023/12/28/4 http://www.openwall.com/lists/oss-security/2024/01/03/4
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.