Skip to content
OpenAdvisories
Unscored CVE-2019-9852 EUVD-2019-19208GHSA-vgrf-j225-8963

Insufficient URL encoding flaw in allowed script location check

Published Aug 15, 2019 · Updated Sep 17, 2024 · Assigned by Document Fdn.

Vendor: Document Foundation Product: LibreOffice Package: libreoffice Package: libreoffice Package: libreoffice Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu

Description

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2018-16858, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed. However this new protection could be bypassed by a URL encoding attack. In the fixed versions, the parsed url describing the script location is correctly encoded before further processing. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.

Affected products

VendorProductAffectedFixed
Document Foundation LibreOffice unspecified – < 6.2.6 6.2.6

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 libreoffice 1:6.3.0-1 —
Debian 13 libreoffice 1:6.3.0-1 —
Debian 12 libreoffice 1:6.3.0-1 —
Debian 10 libreoffice 1:6.1.5-3+deb10u3 DSA-4501-1
Debian 9 libreoffice 1:5.2.7-1+deb9u10 DSA-4501-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Debian 8 libreoffice 1:4.3.3-2+deb8u13 DLA-1947-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS libreoffice 1:6.0.7-0ubuntu0.18.04.9 USN-4102-1
Ubuntu 16.04 LTS libreoffice 1:5.1.6~rc2-0ubuntu1~xenial9 USN-4102-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 8 autocorr-af +172 1:6.0.6.1-20.el8 RHSA-2020:1598
RHEL 7 autocorr-af +112 1:5.3.6.1-24.el7 RHSA-2020:1151

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP1 libreoffice 6.2.7.1-8.10.1 SUSE-SU-2019:2402-1
SLES 15 libreoffice 6.2.6.2-3.21.1 SUSE-SU-2019:2231-1
SLES 12 SP4 libreoffice 6.2.7.1-43.56.3 SUSE-SU-2019:2401-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 15.1 libreoffice 6.2.7.1-lp151.3.6.1 openSUSE-SU-2019:2183-1
openSUSE Leap 15.0 libreoffice 6.2.6.2-lp150.2.16.1 openSUSE-SU-2019:2057-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 libreoffice 6.3.0.4-r0 —
Alpine v3.23 libreoffice 6.3.0.4-r0 —
Alpine v3.22 libreoffice 6.3.0.4-r0 —
Alpine v3.21 libreoffice 6.3.0.4-r0 —
Alpine v3.20 libreoffice 6.3.0.4-r0 —
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 libreoffice 6.3.0.4-r0 —
Alpine v3.18 libreoffice 6.3.0.4-r0 —
Alpine v3.17 libreoffice 6.3.0.4-r0 —
Alpine v3.16 libreoffice 6.3.0.4-r0 —
Alpine v3.15 libreoffice 6.3.0.4-r0 —
Alpine v3.14 libreoffice 6.3.0.4-r0 —
Alpine v3.13 libreoffice 6.3.0.4-r0 —
Alpine v3.12 libreoffice 6.3.0.4-r0 —
Alpine v3.11 libreoffice 6.3.0.4-r0 —
Alpine v3.10 libreoffice 6.2.6.2-r0 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 autocorr-af +171 1:6.0.6.1-20.0.1.el8 ELSA-2020-1598
Oracle Linux 7 autocorr-af +180 1:5.3.6.1-24.0.1.el7 ELSA-2020-1151

Advisories 13

References