CVE-2019-9851: fallo en Document Foundation LibreOffice
LibreLogo global-event script execution
Publicada el · Actualizada el
60Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendepss 78%
de la publicación al arma6 días
Publicada en NVD15 ago
1ª PoC+6d
metasploit16 jul
probabilidad de explotación
78%top 1% de las CVE
explotación observada
noninguna fuente lo reporta
2 exploit(s) público(s)
Lo que declaran los fabricantes (VEX)
Declaraciones oficiales de los fabricantes en formato CSAF/VEX: si su producto está afectado, ya corregido o descartado — y por qué. Es afirmación del fabricante, no juicio de Vexday.
Red Hatdocumento VEX ↗
Afectado
1 producto (133 componentes)
Red Hat Enterprise Linux 6
no_fix_planned: Out of support scope
Corregido
7 productos (1530 componentes)
Red Hat CodeReady Linux Builder (v. 8) · Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux Client (v. 7) · Red Hat Enterprise Linux Client Optional (v. 7) · Red Hat Enterprise Linux Server Optional (v. 7) · y otros 2
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from document event script handers, e.g. mouse over. However LibreOffice also has a separate feature where documents can specify that pre-installed scripts can be executed on various global script events such as document-open, etc. In the fixed versions, global script event handlers are validated equivalently to document script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
Productos afectados
Document Foundation · LibreOfficePoCs públicas encontradas — 2
exploitdbwww.exploit-db.com/exploits/47298no verificadocve_referencepacketstormsecurity.com/files/154168/LibreOffice-Macro-Python-Code-Execution.htmlno verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Document Foundation LibreOffice
En el mismo producto, de las más peligrosas a las menos.
CVE-2019-9848—CVE-2019-9848EPSS 28.9%CVE-2019-9853—Insufficient URL decoding flaw in categorizing macro locationEPSS 3.1%CVE-2019-9850—Insufficient url validation allowing LibreLogo script executionEPSS 2.9%CVE-2019-9849—CVE-2019-9849EPSS 2.6%CVE-2019-9855—Windows 8.3 path equivalence handling flaw allows LibreLogo script executionEPSS 2.6%CVE-2019-9854—Unsafe URL assembly flaw in allowed script location checkEPSS 1.8%
Referencias
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.htmlhttp://packetstormsecurity.com/files/154168/LibreOffice-Macro-Python-Code-Execution.htmlhttps://lists.debian.org/debian-lts-announce/2019/10/msg00005.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PMEGUWMWORC3DOVEHVXLFT3A5RSCMLBH/https://seclists.org/bugtraq/2019/Aug/28https://usn.ubuntu.com/4102-1/https://www.debian.org/security/2019/dsa-4501https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9851