Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-9848 — Code Injection in Foundation Libreoffice

CWE-94 — Code InjectionCWE-20 — Improper Input Validation22 documents8 sources
Severity
9.8CRITICALNVD
EPSS
86.6%
top 0.58%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
7
Document Foundation LibreofficeLibreofficeDebian Libreoffice+4 more
Timeline
PublishedJul 17
Latest updateMay 24

Description

LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. LibreOffice is typically also bundled with LibreLogo, a programmable turtle vector graphics script, which can be manipulated into executing arbitrary python commands. By using the document event feature to trigger LibreLogo to execute python contained within a document a malicious document could be constructed which would execute arbitrary python co…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages6 packages

▶CVEListV5document_foundation/libreofficeunspecified — 6.2.6
▶debiandebian/libreoffice< libreoffice 1:6.3.0-1 (bookworm)+1
▶Debianlibreoffice/libreoffice< 1:6.3.0-1+7
▶Ubuntulibreoffice/libreoffice< 1:5.1.6~rc2-0ubuntu1~xenial8+1

Also affects: Debian Linux 10.0, 8.0, 9.0, Fedora 29, 30, Ubuntu Linux 16.04, 18.04, 19.04

🔴Vulnerability Details

7
GHSA
GHSA-4vpq-gvj2-8j36: LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc↗2022-05-24
▶
GHSA
GHSA-vq62-85wx-mmv3: LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained w↗2022-05-24
▶
GHSA
GHSA-2rm2-3r73-2vfr: LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained w↗2022-05-24
▶
OSV
CVE-2019-9850: LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained w↗2019-08-15
▶
OSV
CVE-2019-9851: LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained w↗2019-08-15
▶

💥Exploits & PoCs

1
Exploit-DB
LibreOffice < 6.2.6 Macro - Python Code Execution (Metasploit)↗2019-08-21
▶

📋Vendor Advisories

7
Red Hat
libreoffice: LibreLogo global-event script execution↗2019-08-15
▶
Red Hat
libreoffice: Insufficient URL validation allowing LibreLogo script execution↗2019-08-15
▶
Red Hat
libreoffice: LibreLogo script can be manipulated into executing arbitrary python commands↗2019-08-05
▶
Ubuntu
LibreOffice vulnerabilities↗2019-07-17
▶
Debian
CVE-2019-9850: libreoffice - LibreOffice is typically bundled with LibreLogo, a programmable turtle vector gr...↗2019
▶

💬Community

4
Bugzilla
CVE-2019-9851 libreoffice: LibreLogo global-event script execution↗2019-08-23
▶
Bugzilla
CVE-2019-9850 libreoffice: Insufficient URL validation allowing LibreLogo script execution↗2019-08-23
▶
Bugzilla
CVE-2019-9848 libreoffice: LibreLogo script can be manipulated into executing arbitrary python commands↗2019-08-05
▶
Bugzilla
CVE-2019-9848 libreoffice: LibreLogo, a graphics script, can be manipulated into executing arbitrary python commands [fedora-all]↗2019-08-05
▶