NetSight
IP …
critical9.8

CVE-2019-9848

LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc.

Impact

LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. LibreOffice is typically also bundled with LibreLogo, a programmable turtle vector graphics script, which can be manipulated into executing arbitrary python commands. By using the document event feature to trigger LibreLogo to execute python contained within a document a malicious document could be constructed which would execute arbitrary python commands silently without warning. In the fixed versions, LibreLogo cannot be called from a document event handler. This issue affects: Document Foundation LibreOffice versions prior to 6.2.5.

Affected products

VendorProductAffected versions
LibreofficeLibreoffice
before 6.2.5
CanonicalUbuntu Linux
Versions 16.04, 18.04, 19.04
FedoraprojectFedora
Versions 29, 30
DebianDebian Linux
Version 8.0
OpensuseLeap
Versions 15.0, 15.1

Weakness classification

CWE-94

References