Skip to content
OpenAdvisories
Unscored CVE-2019-9854 EUVD-2019-19210GHSA-54x7-phmv-8vq8

Unsafe URL assembly flaw in allowed script location check

Published Sep 6, 2019 · Updated Sep 16, 2024 · Assigned by Document Fdn.

Vendor: Document Foundation Product: LibreOffice Package: libreoffice Package: libreoffice Package: libreoffice Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu

Description

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2019-9852, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed by employing a URL encoding attack to defeat the path verification step. However this protection could be bypassed by taking advantage of a flaw in how LibreOffice assembled the final script URL location directly from components of the passed in path as opposed to solely from the sanitized output of the path verification step. This issue affects: Document Foundation LibreOffice 6.2 versions prior to 6.2.7; 6.3 versions prior to 6.3.1.

Affected products

VendorProductAffectedFixed
Document Foundation LibreOffice 6.2 – < 6.2.7, 6.3 – < 6.3.1 6.2.7

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 libreoffice 1:6.3.1~rc2-1 —
Debian 13 libreoffice 1:6.3.1~rc2-1 —
Debian 12 libreoffice 1:6.3.1~rc2-1 —
Debian 10 libreoffice 1:6.1.5-3+deb10u4 DSA-4519-1
Debian 9 libreoffice 1:5.2.7-1+deb9u11 DSA-4519-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Debian 8 libreoffice 1:4.3.3-2+deb8u13 DLA-1947-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS libreoffice 1:6.0.7-0ubuntu0.18.04.10 USN-4138-1
Ubuntu 16.04 LTS libreoffice 1:5.1.6~rc2-0ubuntu1~xenial10 USN-4138-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 8 autocorr-af +172 1:6.0.6.1-20.el8 RHSA-2020:1598
RHEL 7 autocorr-af +112 1:5.3.6.1-24.el7 RHSA-2020:1151

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP1 libreoffice 6.2.7.1-8.10.1 SUSE-SU-2019:2402-1
SLES 15 libreoffice 6.2.7.1-3.24.4 SUSE-SU-2019:2686-1
SLES 12 SP4 libreoffice 6.2.7.1-43.56.3 SUSE-SU-2019:2401-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed libreoffice 7.1.5.2-3.13 openSUSE-SU-2024:10983-1
openSUSE Leap 15.1 libreoffice 6.2.7.1-lp151.3.6.1 openSUSE-SU-2019:2183-1
openSUSE Leap 15.0 libreoffice 6.2.7.1-lp150.2.19.1 openSUSE-SU-2019:2361-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 libreoffice 6.3.1.2-r0 —
Alpine v3.23 libreoffice 6.3.1.2-r0 —
Alpine v3.22 libreoffice 6.3.1.2-r0 —
Alpine v3.21 libreoffice 6.3.1.2-r0 —
Alpine v3.20 libreoffice 6.3.1.2-r0 —
Show 10 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 libreoffice 6.3.1.2-r0 —
Alpine v3.18 libreoffice 6.3.1.2-r0 —
Alpine v3.17 libreoffice 6.3.1.2-r0 —
Alpine v3.16 libreoffice 6.3.1.2-r0 —
Alpine v3.15 libreoffice 6.3.1.2-r0 —
Alpine v3.14 libreoffice 6.3.1.2-r0 —
Alpine v3.13 libreoffice 6.3.1.2-r0 —
Alpine v3.12 libreoffice 6.3.1.2-r0 —
Alpine v3.11 libreoffice 6.3.1.2-r0 —
Alpine v3.10 libreoffice 6.2.7.1-r0 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 autocorr-af +171 1:6.0.6.1-20.0.1.el8 ELSA-2020-1598
Oracle Linux 7 autocorr-af +180 1:5.3.6.1-24.0.1.el7 ELSA-2020-1151

Advisories 14

References