libreoffice: Multiple vulnerabilities (CVE-2019-9850, CVE-2019-9851, CVE-2019-9852)
CVE-2019-9850 Insufficient url validation allowing LibreLogo script execution
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from.
LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc
Protection was added, to address CVE-2019-9848, to block calling LibreLogo from script event handers. However an insufficient url validation vulnerability in LibreOffice allowed malicious to bypass that protection and again trigger calling LibreLogo from script event handlers. In the fixed versions, script urls are correctly decoded before validation
Fixed In Version:
libreoffice 6.2.6/6.3.0
Reference:
https://www.libreoffice.org/about-us/security/advisories/cve-2019-9850/
CVE-2019-9851 LibreLogo global-event script execution
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from.
Protection was added, to address CVE-2019-9848, to block calling LibreLogo from document event script handers, e.g. mouse over. However LibreOffice also has a separate feature where documents can specify that pre-installed scripts can be executed on various global script events such as document-open, etc In the fixed versions, global script event handlers are validated equivalently to document script event handlers.
Fixed In Version:
libreoffice 6.2.6/6.3.0
Reference:
https://www.libreoffice.org/about-us/security/advisories/cve-2019-9851/
CVE-2019-9852 Insufficient URL encoding flaw in allowed script location check
LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install.
Protection was added, to address CVE-2018-16858, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed. However this new protection could be bypassed by a URL encoding attack. In the fixed versions, the parsed url describing the script location is correctly encoded before further processing.
Fixed In Version:
libreoffice 6.2.6/6.3.0
Reference:
https://www.libreoffice.org/about-us/security/advisories/cve-2019-9852/
Affected branches:
-
master -
3.10-stable