CVE-2019-9851 LibreLogo global-event script execution

2019-08-1500:00:00

Document Fdn.

www.cve.org

9.8 High

AI Score

Confidence

High

0.971 High

EPSS

Percentile

99.8%

JSON

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from document event script handers, e.g. mouse over. However LibreOffice also has a separate feature where documents can specify that pre-installed scripts can be executed on various global script events such as document-open, etc. In the fixed versions, global script event handlers are validated equivalently to document script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.

CNA Affected

[
  {
    "product": "LibreOffice",
    "vendor": "Document Foundation",
    "versions": [
      {
        "lessThan": "6.2.6",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]