Description
LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed where bullet graphics were omitted from this protection prior to version 6.2.5. This issue affects: Document Foundation LibreOffice versions prior to 6.2.5.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Document Foundation | LibreOffice | unspecified – < 6.2.5 | 6.2.5 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libreoffice | 1:6.3.0~rc1-1 | — |
| Debian 13 | libreoffice | 1:6.3.0~rc1-1 | — |
| Debian 12 | libreoffice | 1:6.3.0~rc1-1 | — |
| Debian 10 | libreoffice | 1:6.1.5-3+deb10u2 | DSA-4483-1 |
| Debian 9 | libreoffice | 1:5.2.7-1+deb9u9 | DSA-4483-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 8 | libreoffice | 1:4.3.3-2+deb8u13 | DLA-1947-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libreoffice | 1:6.0.7-0ubuntu0.18.04.8 | USN-4063-1 |
| Ubuntu 16.04 LTS | libreoffice | 1:5.1.6~rc2-0ubuntu1~xenial8 | USN-4063-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | autocorr-af +172 | 1:6.0.6.1-20.el8 | RHSA-2020:1598 |
| RHEL 7 | autocorr-af +112 | 1:5.3.6.1-24.el7 | RHSA-2020:1151 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | libreoffice | 6.2.7.1-8.10.1 | SUSE-SU-2019:2402-1 |
| SLES 15 | libreoffice | 6.2.6.2-3.21.1 | SUSE-SU-2019:2231-1 |
| SLES 12 SP4 | libreoffice | 6.2.7.1-43.56.3 | SUSE-SU-2019:2401-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | libreoffice | 6.2.7.1-lp151.3.6.1 | openSUSE-SU-2019:2183-1 |
| openSUSE Leap 15.0 | libreoffice | 6.2.6.2-lp150.2.16.1 | openSUSE-SU-2019:2057-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | libreoffice | 6.2.5.2-r0 | — |
| Alpine v3.23 | libreoffice | 6.2.5.2-r0 | — |
| Alpine v3.22 | libreoffice | 6.2.5.2-r0 | — |
| Alpine v3.21 | libreoffice | 6.2.5.2-r0 | — |
| Alpine v3.20 | libreoffice | 6.2.5.2-r0 | — |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | libreoffice | 6.2.5.2-r0 | — |
| Alpine v3.18 | libreoffice | 6.2.5.2-r0 | — |
| Alpine v3.17 | libreoffice | 6.2.5.2-r0 | — |
| Alpine v3.16 | libreoffice | 6.2.5.2-r0 | — |
| Alpine v3.15 | libreoffice | 6.2.5.2-r0 | — |
| Alpine v3.14 | libreoffice | 6.2.5.2-r0 | — |
| Alpine v3.13 | libreoffice | 6.2.5.2-r0 | — |
| Alpine v3.12 | libreoffice | 6.2.5.2-r0 | — |
| Alpine v3.11 | libreoffice | 6.2.5.2-r0 | — |
| Alpine v3.10 | libreoffice | 6.2.5.2-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | autocorr-af +171 | 1:6.0.6.1-20.0.1.el8 | ELSA-2020-1598 |
| Oracle Linux 7 | autocorr-af +180 | 1:5.3.6.1-24.0.1.el7 | ELSA-2020-1151 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
mbadanoiu/CVE-2019-9849 ★ 0 · Jun 24, 2024
CVE-2019-9849: Remote bullet graphics retrieved in “stealth mode” in LibreOffice
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 13
- RHSA-2020:1151 Red Hat Security Advisory: libreoffice security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2020:1598 Red Hat Security Advisory: libreoffice security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-4063-1 libreoffice vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-4483-1 libreoffice - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1947-1 libreoffice - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2019:2401-1 Security update for libreoffice SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2402-1 Security update for libreoffice SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2057-1 Security update for libreoffice SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2231-1 Security update for libreoffice SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:2183-1 Security update for libreoffice SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2023-2485 LibreOffice: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 27, 2023
- ELSA-2020-1598 Moderate: libreoffice security and bug fix update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 5, 2020
- ELSA-2020-1151 Moderate: libreoffice security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Apr 6, 2020
References
- https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9849
- USN-4063-1 vendor-advisory
- FEDORA-2019-5561d20558 vendor-advisory
- 109374 vdb-entry
- GLSA-201908-13 vendor-advisory
- FEDORA-2019-2fe22a3a2c vendor-advisory
- openSUSE-SU-2019:2057 vendor-advisory
- openSUSE-SU-2019:2183 vendor-advisory
- [debian-lts-announce] 20191006 [SECURITY] [DLA 1947-1] libreoffice security update mailing-list