Input validation error in LibreOffice - CVE-2019-9851

Vulnerability identifier: #VU20860

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber

CVE-ID: CVE-2019-9851

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

Affected software:
LibreOffice
libreoffice (Debian package)
libreoffice (Red Hat package)
libreoffice (Alpine package)
libreoffice
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Opensuse
Fedora

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to the affected software mishandles LibreLogo scripts. A remote attacker can persuade a user to open a specially crafted document and execute arbitrary commands on an affected system.

Install updates from vendor's website.

• https://usn.ubuntu.com/4102-1/
• https://www.debian.org/security/2019/dsa-4501
• https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9851