Summary
Nils Emmerich discovered that LibreOffice incorrectly handled LibreLogo
scripts. If a user were tricked into opening a specially crafted document,
a remote attacker could cause LibreOffice to execute arbitrary code.
(CVE-2019-9848)
Matei "Mal" Badanoiu discovered that LibreOffice incorrectly handled
stealth mode. Contrary to expectations, bullet graphics could be retrieved
from remote locations when running in stealth mode. (CVE-2019-9849)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 16.04 LTS 16.04:LTS | libreoffice | 1:5.1.6~rc2-0ubuntu1~xenial8 |
| Ubuntu · 18.04 LTS 18.04:LTS | libreoffice | 1:6.0.7-0ubuntu0.18.04.8 |
Vulnerabilities 2
-
Unscored —CVE-2019-9848 EPSS 29%
LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document ev…
-
Unscored —CVE-2019-9849 Public exploit
LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote…