QID 356235

libreoffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc.
Libreoffice is typically also bundled with librelogo, a programmable turtle vector graphics script, which can be manipulated into executing arbitrary python commands.
By using the document event feature to trigger librelogo to execute python contained within a document a malicious document could be constructed which would execute arbitrary python commands silently without warning.
In the fixed versions, librelogo cannot be called from a document event handler.
This issue affects: document foundation libreoffice versions prior to 6.2.5. (
( CVE-2019-9848) libreoffice has a stealth mode in which only documents from locations deemed trusted are allowed to retrieve remote resources.
This mode is not the default mode, but can be enabled by users who want to disable libreoffices ability to include remote resources within a document.
A flaw existed where bullet graphics were omitted from this protection prior to version 6.2.5.
( CVE-2019-9849) libreoffice is typically bundled with librelogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from.
Libreoffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc.
Protection was added, to address( CVE-2019-9848, to block calling librelogo from script event handers.
This issue affects: document foundation libreoffice versions prior to 6.2.6. (
However this new protection could be bypassed by a url encoding attack.

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

Successful exploitation of this vulnerability could lead to a securitybreach or could affect integrity, availability, and confidentiality.