Read the docs
Red Hat Security Advisory

RHSA-2020:1598

libreoffice security and bug fix update

Released 2020-04-28 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 6 records

TI-2019-07233 CVE-2019-9851 · GHSA-2rm2-3r73-2vfr

LibreLogo global-event script execution

Priority HIGH 82

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.77837 Published 2019-08-15 Partial fix · 6.2.6 CWE-20
TI-2019-07232 CVE-2019-9850 · GHSA-vq62-85wx-mmv3

Insufficient url validation allowing LibreLogo script execution

Priority MEDIUM 47

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02928 Published 2019-08-15 Partial fix · 6.2.6 CWE-20
TI-2019-07236 CVE-2019-9854 · GHSA-54x7-phmv-8vq8

Unsafe URL assembly flaw in allowed script location check

Priority LOW 38

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01756 Published 2019-09-06 Partial fix · 6.2.7, 6.3.1 CWE-22
TI-2019-07234 CVE-2019-9852 · GHSA-vgrf-j225-8963

Insufficient URL encoding flaw in allowed script location check

Priority LOW 38

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01752 Published 2019-08-15 Partial fix · 6.2.6 CWE-116