CVE-2019-9852 — Improper Encoding or Escaping of Output in Foundation Libreoffice
Severity
7.8HIGHNVD
OSV9.8
EPSS
0.1%
top 71.13%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedAug 15
Latest updateMay 24
Description
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2018-16858, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed. However this new protection could b…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages6 packages
Also affects: Debian Linux 10.0, 8.0, 9.0, Fedora 29, Ubuntu Linux 16.04, 18.04, 19.04, Enterprise Linux 7.0, 8.0
Patches
🔴Vulnerability Details
7GHSA▶
GHSA-vgrf-j225-8963: LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-↗2022-05-24
GHSA▶
GHSA-54x7-phmv-8vq8: LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-↗2022-05-24
OSV▶
CVE-2019-9854: LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-↗2019-09-06