Red Hat Security Advisory: libreoffice security and bug fix update

Fixed packages 342

Vulnerabilities 7

• Unscored —
  CVE-2019-9848 EPSS 29%

  LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document ev…

  Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu Alpine
  Jul 17, 2019
• Unscored —
  CVE-2019-9849 Public exploit

  LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote…

  Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu Alpine
  Jul 17, 2019
• Unscored —
  CVE-2019-9850

  Insufficient url validation allowing LibreLogo script execution

  LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-ins…

  Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu Alpine
  Aug 15, 2019
• Unscored —
  CVE-2019-9851 Public exploit EPSS 78%

  LibreLogo global-event script execution

  LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Protection was added, to address CVE-2019-9848, to block calling LibreL…

  Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu Alpine
  Aug 15, 2019
• Unscored —
  CVE-2019-9852

  Insufficient URL encoding flaw in allowed script location check

  LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python …

  Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu Alpine
  Aug 15, 2019
• Unscored —
  CVE-2019-9853

  Insufficient URL decoding flaw in categorizing macro location

  LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically execution of macros are blocked by default. A URL decoding flaw existed in how the urls to the macros within the document were p…

  Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu
  Sep 27, 2019
• Unscored —
  CVE-2019-9854

  Unsafe URL assembly flaw in allowed script location check

  LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python …

  Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu Alpine
  Sep 6, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1601372
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1728763
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1737421
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1737427
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1744862
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1744866
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1744868
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1769907
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1797466
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1151.json
• report
  https://access.redhat.com/security/cve/CVE-2019-9848
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9848
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9848
• article
  https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9848
• report
  https://access.redhat.com/security/cve/CVE-2019-9849
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9849
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9849
• article
  https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9849
• report
  https://access.redhat.com/security/cve/CVE-2019-9850
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9850
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9850
• article
  https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9850
• report
  https://access.redhat.com/security/cve/CVE-2019-9851
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9851
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9851
• article
  https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9851
• report
  https://access.redhat.com/security/cve/CVE-2019-9852
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9852
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9852
• article
  https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9852
• report
  https://access.redhat.com/security/cve/CVE-2019-9853
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9853
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9853
• article
  https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9853/
• report
  https://access.redhat.com/security/cve/CVE-2019-9854
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-9854
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-9854