CVE-2019-9848

high-risk

Published 2019-07-17

LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. LibreOffice is typically also bundled with LibreLogo, a programmable turtle vector graphics script, which can be manipulated into executing arbitrary python commands. By using the document event feature to trigger LibreLogo to execute python contained within a document a malicious document could be constructed which would execute arbitrary python commands silently without warning. In the fixed versions, LibreLogo cannot be called from a document event handler. This issue affects: Document Foundation LibreOffice versions prior to 6.2.5.

Do I need to act?

86.6% chance of exploitation in next 30 days

EPSS score — higher than 13% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Fix available

Upgrade to: af17b2cd26a1e36edf0b995f81a2e0757086dad1

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (9)

Libreoffice

Ubuntu Linux

Fedora

Debian Linux

Leap

Affected Vendors

Debian Canonical Fedoraproject Opensuse Libreoffice

References (20)

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00006.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.html

Broken Link http://www.securityfocus.com/bid/109374

Mailing List https://lists.debian.org/debian-lts-announce/2019/10/msg00005.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Mailing List https://seclists.org/bugtraq/2019/Aug/28

Third Party Advisory https://security.gentoo.org/glsa/201908-13

Third Party Advisory https://usn.ubuntu.com/4063-1/

Vendor Advisory https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9848