CVE-2019-9854
Summary
| CVE | CVE-2019-9854 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2019-09-06 19:15:00 UTC |
| Updated | 2023-11-07 03:13:00 UTC |
| Description | LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2019-9852, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed by employing a URL encoding attack to defeat the path verification step. However this protection could be bypassed by taking advantage of a flaw in how LibreOffice assembled the final script URL location directly from components of the passed in path as opposed to solely from the sanitized output of the path verification step. This issue affects: Document Foundation LibreOffice 6.2 versions prior to 6.2.7; 6.3 versions prior to 6.3.1. |
Risk And Classification
Problem Types: CWE-22
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Canonical | Ubuntu Linux | 16.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 18.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 19.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 16.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 18.04 | All | All | All |
| Operating System | Canonical | Ubuntu Linux | 19.04 | All | All | All |
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Operating System | Debian | Debian Linux | 8.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Operating System | Fedoraproject | Fedora | 29 | All | All | All |
| Operating System | Fedoraproject | Fedora | 29 | All | All | All |
| Application | Libreoffice | Libreoffice | All | All | All | All |
| Application | Libreoffice | Libreoffice | All | All | All | All |
| Operating System | Opensuse | Leap | 15.0 | All | All | All |
| Operating System | Opensuse | Leap | 15.1 | All | All | All |
| Operating System | Opensuse | Leap | 15.0 | All | All | All |
| Operating System | Opensuse | Leap | 15.1 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 8.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 7.0 | All | All | All |
| Operating System | Redhat | Enterprise Linux | 8.0 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Bugtraq: [SECURITY] [DSA 4519-1] libreoffice security update | BUGTRAQ | seclists.org | Mailing List, Third Party Advisory |
| CVE-2019-9854 | LibreOffice - Free Office Suite - Fun Project - Fantastic People | CONFIRM | www.libreoffice.org | Vendor Advisory |
| [security-announce] openSUSE-SU-2019:2183-1: moderate: Security update f | SUSE | lists.opensuse.org | Third Party Advisory |
| [security-announce] openSUSE-SU-2019:2361-1: moderate: Security update f | SUSE | lists.opensuse.org | Third Party Advisory |
| Debian -- Security Information -- DSA-4519-1 libreoffice | DEBIAN | www.debian.org | Third Party Advisory |
| [SECURITY] [DLA 1947-1] libreoffice security update | MLIST | lists.debian.org | Third Party Advisory |
| 1769907 – (CVE-2019-9854) CVE-2019-9854 libreoffice: Unsafe URL assembly flaw in allowed script location check | MISC | bugzilla.redhat.com | Third Party Advisory |
| [SECURITY] Fedora 29 Update: libreoffice-6.1.6.3-4.fc29 - package-announce - Fedora Mailing-Lists | FEDORA | lists.fedoraproject.org | Third Party Advisory |
| [SECURITY] Fedora 29 Update: libreoffice-6.1.6.3-4.fc29 - package-announce - Fedora Mailing-Lists | lists.fedoraproject.org | ||
| USN-4138-1: LibreOffice vulnerability | Ubuntu security notices | Ubuntu | UBUNTU | usn.ubuntu.com | Third Party Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
LEGACY: Thanks to RiceX(@ricex_cc) for reporting this issue
Legacy QID Mappings
- 356235 Amazon Linux Security Advisory for libreoffice : ALASLIBREOFFICE-2023-002
- 377399 Alibaba Cloud Linux Security Update for libreoffice (ALINUX3-SA-2022:0038)
- 377446 Alibaba Cloud Linux Security Update for libreoffice (ALINUX2-SA-2020:0048)
- 501054 Alpine Linux Security Update for libreoffice
- 505020 Alpine Linux Security Update for libreoffice