EUVD-2019-19208

Malware in sbrugna...

Oracle Linux 7 : libreoffice (ELSA-2020-1151)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-1151 advisory. - Resolves: rhbz1743962 CVE-2019-9848 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

Debian DLA-1947-1 : libreoffice security update

Several vulnerabilities were discovered in LibreOffice, the office productivity suite. CVE-2019-9848 Nils Emmerich discovered that malicious documents could execute arbitrary Python code via LibreLogo. CVE-2019-9849 Matei Badanoiu discovered that the stealth mode did not apply to bullet graphics...

Directory traversal

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice...

CVE-2019-9852

LibreOffice CVE-2019-9852 is an insufficient URL encoding flaw in the allowed script location check for pre-installed macros, which could allow bypassing path verification and executing scripts. Affected products are Document Foundation LibreOffice versions prior to 6.2.6. Remediation per connect...