CVE-2019-9852: Insufficient URL encoding flaw in allowed script location check
A vulnerability was found in LibreOffice prior to 6.2.6. LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2018-16858, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed. However this new protection could be bypassed by a URL encoding attack. In the fixed versions, the parsed url describing the script location is correctly encoded before further processing.
Reference: https://seclists.org/bugtraq/2019/Aug/28
Other sources
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2018-16858, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed. However this new protection could be bypassed by a URL encoding attack. In the fixed versions, the parsed url describing the script location is correctly encoded before further processing. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/LibreOfficeto a version that resolves this vulnerability.Fixed in 6.2.6 - Upgrade
Upgrade
redhat/LibreOfficeto a version that resolves this vulnerability.Fixed in 6.3.0 - Upgrade
Upgrade
debian/libreofficeto a version that resolves this vulnerability.Fixed in 1:7.0.4-4+deb11u10Fixed in 1:7.0.4-4+deb11u13Fixed in 4:7.4.7-1+deb12u10Fixed in 4:7.4.7-1+deb12u8Fixed in 4:25.2.3-2+deb13u3Fixed in 4:26.2.0-1 - Upgrade
Upgrade
alpine/libreofficeto a version that resolves this vulnerability.Fixed in 6.2.6.2-r0 - Upgrade
Upgrade
alpine/libreofficeto a version that resolves this vulnerability.Fixed in 6.3.0.4-r0 - Upgrade
Upgrade
LibreOfficeto a version that resolves this vulnerability.Fixed in 6.2.6
Event History
Frequently Asked Questions
What is CVE-2019-9852?
CVE-2019-9852 is a vulnerability in LibreOffice that allows documents to execute pre-installed macros on various script events, which can lead to unauthorized execution of potentially malicious code.
How severe is CVE-2019-9852?
CVE-2019-9852 has a severity rating of 7.8, which is considered high.
What software is affected by CVE-2019-9852?
LibreOffice versions 6.0.7-0ubuntu0.18.04.9, 6.2.6-0ubuntu0.19.04.1, 6.3.0-1, 5.1.6~, 6.2.6, and 6.3.0 are affected by CVE-2019-9852.
How can I fix CVE-2019-9852?
To fix CVE-2019-9852, update LibreOffice to versions 6.0.7-0ubuntu0.18.04.9, 6.2.6-0ubuntu0.19.04.1, 6.3.0-1, 5.1.6~, 6.2.6, or 6.3.0 or apply the necessary patches provided by your operating system or software vendor.
Where can I find more information about CVE-2019-9852?
You can find more information about CVE-2019-9852 at the following references: [link1], [link2], [link3].