Skip to content
OpenAdvisories
Unscored USN-4138-1 1 CVE

libreoffice vulnerability

Published Sep 24, 2019 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

It was discovered that LibreOffice incorrectly handled embedded scripts in
document files. If a user were tricked into opening a specially crafted
document, a remote attacker could possibly execute arbitrary code.

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 16.04 LTS 16.04:LTS libreoffice 1:5.1.6~rc2-0ubuntu1~xenial10
Ubuntu · 18.04 LTS 18.04:LTS libreoffice 1:6.0.7-0ubuntu0.18.04.10

Vulnerabilities 1

  • Unscored —
    CVE-2019-9854

    Unsafe URL assembly flaw in allowed script location check

    LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python …

    Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2019-9854