CVE-2019-9851: falha em Document Foundation LibreOffice
LibreLogo global-event script execution
Publicada em · Atualizada em
60Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendepss 78%
da publicação à arma6 dias
Publicada no NVD15 de ago.
1ª PoC+6d
metasploit16 de jul.
probabilidade de exploração
78%top 1% das CVEs
exploração observada
nãonenhuma fonte reporta
2 exploit(s) público(s)
O que os fabricantes declaram (VEX)
Declarações oficiais dos fabricantes em formato CSAF/VEX: se o produto deles está afetado, já corrigido ou descartado — e por quê. É afirmação do fabricante, não juízo do Vexday.
Red Hatdocumento VEX ↗
Afetado
1 produto (133 componentes)
Red Hat Enterprise Linux 6
no_fix_planned: Out of support scope
Corrigido
7 produtos (1.530 componentes)
Red Hat CodeReady Linux Builder (v. 8) · Red Hat Enterprise Linux AppStream (v. 8) · Red Hat Enterprise Linux Client (v. 7) · Red Hat Enterprise Linux Client Optional (v. 7) · Red Hat Enterprise Linux Server Optional (v. 7) · e outros 2
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from document event script handers, e.g. mouse over. However LibreOffice also has a separate feature where documents can specify that pre-installed scripts can be executed on various global script events such as document-open, etc. In the fixed versions, global script event handlers are validated equivalently to document script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
Produtos afetados
Document Foundation · LibreOfficePoCs públicas encontradas — 2
exploitdbwww.exploit-db.com/exploits/47298não verificadocve_referencepacketstormsecurity.com/files/154168/LibreOffice-Macro-Python-Code-Execution.htmlnão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — Document Foundation LibreOffice
No mesmo produto, das mais perigosas para as menos.
CVE-2019-9848—CVE-2019-9848EPSS 28.9%CVE-2019-9853—Insufficient URL decoding flaw in categorizing macro locationEPSS 3.1%CVE-2019-9850—Insufficient url validation allowing LibreLogo script executionEPSS 2.9%CVE-2019-9849—CVE-2019-9849EPSS 2.6%CVE-2019-9855—Windows 8.3 path equivalence handling flaw allows LibreLogo script executionEPSS 2.6%CVE-2019-9854—Unsafe URL assembly flaw in allowed script location checkEPSS 1.8%
Referências
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.htmlhttp://packetstormsecurity.com/files/154168/LibreOffice-Macro-Python-Code-Execution.htmlhttps://lists.debian.org/debian-lts-announce/2019/10/msg00005.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PMEGUWMWORC3DOVEHVXLFT3A5RSCMLBH/https://seclists.org/bugtraq/2019/Aug/28https://usn.ubuntu.com/4102-1/https://www.debian.org/security/2019/dsa-4501https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9851