CVE-2019-9852: Insufficient URL encoding flaw in allowed script location check
A vulnerability was found in LibreOffice prior to 6.2.6. LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2018-16858, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed. However this new protection could be bypassed by a URL encoding attack. In the fixed versions, the parsed url describing the script location is correctly encoded before further processing.
Reference: https://seclists.org/bugtraq/2019/Aug/28
Other sources
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2018-16858, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed. However this new protection could be bypassed by a URL encoding attack. In the fixed versions, the parsed url describing the script location is correctly encoded before further processing. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-9852?
CVE-2019-9852 is a vulnerability in LibreOffice that allows documents to execute pre-installed macros on various script events, which can lead to unauthorized execution of potentially malicious code.
How severe is CVE-2019-9852?
CVE-2019-9852 has a severity rating of 7.8, which is considered high.
What software is affected by CVE-2019-9852?
LibreOffice versions 6.0.7-0ubuntu0.18.04.9, 6.2.6-0ubuntu0.19.04.1, 6.3.0-1, 5.1.6~, 6.2.6, and 6.3.0 are affected by CVE-2019-9852.
How can I fix CVE-2019-9852?
To fix CVE-2019-9852, update LibreOffice to versions 6.0.7-0ubuntu0.18.04.9, 6.2.6-0ubuntu0.19.04.1, 6.3.0-1, 5.1.6~, 6.2.6, or 6.3.0 or apply the necessary patches provided by your operating system or software vendor.
Where can I find more information about CVE-2019-9852?
You can find more information about CVE-2019-9852 at the following references: [link1], [link2], [link3].