CVE-2019-9851

CVE-2019-9851: vulnerability in Document Foundation LibreOffice

LibreLogo global-event script execution

Published · Updated

60Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 78%
from disclosure to weapon6 days
Published on NVDAug 15
1st PoC+6d
metasploitJul 16
exploitation probability
78%top 1% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
1 product (133 components)
Red Hat Enterprise Linux 6
no_fix_planned: Out of support scope
Fixed
7 products (1,530 components)
Red Hat CodeReady Linux Builder (v. 8) · Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux Client (v. 7) · Red Hat Enterprise Linux Client Optional (v. 7) · Red Hat Enterprise Linux Server Optional (v. 7) · and others 2
fix ↗
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from document event script handers, e.g. mouse over. However LibreOffice also has a separate feature where documents can specify that pre-installed scripts can be executed on various global script events such as document-open, etc. In the fixed versions, global script event handlers are validated equivalently to document script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
Affected products
Document Foundation · LibreOffice
public PoCs found — 2
exploitdbwww.exploit-db.com/exploits/47298unverifiedcve_referencepacketstormsecurity.com/files/154168/LibreOffice-Macro-Python-Code-Execution.htmlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Document Foundation LibreOffice

In the same product, most dangerous first.

CVE-2019-9848—CVE-2019-9848EPSS 28.9%CVE-2019-9853—Insufficient URL decoding flaw in categorizing macro locationEPSS 3.1%CVE-2019-9850—Insufficient url validation allowing LibreLogo script executionEPSS 2.9%CVE-2019-9849—CVE-2019-9849EPSS 2.6%CVE-2019-9855—Windows 8.3 path equivalence handling flaw allows LibreLogo script executionEPSS 2.6%CVE-2019-9854—Unsafe URL assembly flaw in allowed script location checkEPSS 1.8%
References
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.htmlhttp://packetstormsecurity.com/files/154168/LibreOffice-Macro-Python-Code-Execution.htmlhttps://lists.debian.org/debian-lts-announce/2019/10/msg00005.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PMEGUWMWORC3DOVEHVXLFT3A5RSCMLBH/https://seclists.org/bugtraq/2019/Aug/28https://usn.ubuntu.com/4102-1/https://www.debian.org/security/2019/dsa-4501https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9851