Improper access control in LibreOffice - CVE-2019-9854

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU20955

Improper access control in LibreOffice - CVE-2019-9854

Published: September 10, 2019


Vulnerability identifier: #VU20955
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-9854
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to unsafe URL assembly flaw in allowed script location check. A remote authenticated attacker can execute script in arbitrary locations on the filesystem by employing a URL encoding attack to defeat the path verification step.





Affected software

LibreOffice
libreoffice (Ubuntu package)
libreoffice (Debian package)
libreoffice (Red Hat package)
libreoffice (Alpine package)
libreoffice
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Opensuse
Fedora

How to mitigate CVE-2019-9854

Install updates from vendor's website.

LibreOffice - addressed in versions 6.2.7, 6.3.1
libreoffice (Ubuntu package) - addressed in versions 1:5.1.6~rc2-0ubuntu1~xenial10, 1:6.0.7-0ubuntu0.18.04.10, 1:6.2.7-0ubuntu0.19.04.1
libreoffice (Debian package) - addressed in versions 1:5.2.7-1+deb9u11, 1:6.1.5-3+deb10u4
libreoffice (Red Hat package) - addressed in versions 5.3.6.1-24.el7, 6.0.6.1-20.el8
libreoffice (Alpine package) - update to 6.2.7.1-r0
libreoffice - update to 6.1.6.3-4.fc29

External References

Related Security Bulletins