Vulnerability record · CVE-2019-9855 · published 6 September 2019
CVE-2019-9855: Libreoffice vulnerability
Libreoffice · Libreoffice
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc. Protection was added to block calling LibreLogo from script event handers. However a Windows 8.3 path equivalence handling flaw left LibreOffice vulnerable under Windows that a document could trigger executing LibreLogo via a Windows filename pseudonym. This issue affects: Document Foundation LibreOffice 6.2 versions prior to 6.2.7; 6.3 versions prior to 6.3.1.
Description
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc. Protection was added to block calling LibreLogo from script event handers. However a Windows 8.3 path equivalence handling flaw left LibreOffice vulnerable under Windows that a document could trigger executing LibreLogo via a Windows filename pseudonym. This issue affects: Document Foundation LibreOffice 6.2 versions prior to 6.2.7; 6.3 versions prior to 6.3.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.html | Mailing ListThird Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00055.html | Mailing ListThird Party Advisory |
| https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9855/ | Vendor Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.html | Mailing ListThird Party Advisory |
| http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00055.html | Mailing ListThird Party Advisory |
| https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9855/ | Vendor Advisory |
Track CVE-2019-9855 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2019-9855), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
