Code injection in Document Foundation LibreOffice
Priority HIGH 65CWE-94Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 5 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-94.
Summary
LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. LibreOffice is typically also bundled with LibreLogo, a programmable turtle vector graphics script, which can be manipulated into executing arbitrary python commands. By using the document event feature to trigger LibreLogo to execute python contained within a document a malicious document could be constructed which would execute arbitrary python commands silently without warning. In the fixed versions, LibreLogo cannot be called from a document event handler. This issue affects: Document Foundation LibreOffice versions prior to 6.2.5.
Why it matters now
EPSS 0.2887 98th percentileScored 2026-11-07
Fix Partial LibreOffice (Document Foundation): 6.2.5Red Hat: 1 advisoryRed Hat: 5 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| The Document Foundation | LibreOffice | before 6.2.5 | 6.2.5 | Patch available | CNA |
- LibreOffice VendorThe Document Foundation Affected before 6.2.5 Fixed in 6.2.5 Patch available CNA
CPE configurations NVD · 9
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:* | before 6.2.5 | Vulnerable | The Document Foundation |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* | 19.04 | Vulnerable | Canonical |
| cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* | 29 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
- cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:* Versions before 6.2.5 Vulnerable ·The Document Foundation
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical
- cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
Remediation
- Fix · CNA LibreOffice (Document Foundation) Fixed in 6.2.5
Red Hat 1 advisory
- RHSA-2020:1151 Released 2020-03-31 · Red Hat rating Moderatelibreoffice security and bug fix update
- Red Hat Enterprise Linux Client (v. 7) autocorr-af-1:5.3.6.1-24.el7, autocorr-bg-1:5.3.6.1-24.el7, autocorr-ca-1:5.3.6.1-24.el7 +47
- Red Hat Enterprise Linux Client Optional (v. 7) libreoffice-1:5.3.6.1-24.el7, libreoffice-bsh-1:5.3.6.1-24.el7, libreoffice-gdb-debug-support-1:5.3.6.1-24.el7 +47
- Red Hat Enterprise Linux Server Optional (v. 7) autocorr-af-1:5.3.6.1-24.el7, autocorr-bg-1:5.3.6.1-24.el7, autocorr-ca-1:5.3.6.1-24.el7 +47
- Red Hat Enterprise Linux Workstation (v. 7) autocorr-af-1:5.3.6.1-24.el7, autocorr-bg-1:5.3.6.1-24.el7, autocorr-ca-1:5.3.6.1-24.el7 +47
- Red Hat Enterprise Linux Workstation Optional (v. 7) libreoffice-1:5.3.6.1-24.el7, libreoffice-bsh-1:5.3.6.1-24.el7, libreoffice-gdb-debug-support-1:5.3.6.1-24.el7 +47
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Document Foundation LibreOffice — FEDORA-2019-5561d20558
2 records Highest priority Priority HIGH 1 HIGH, 1 LOW
Other records, highest priority first
- TI-2019-07231 LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted'…Priority LOW 25
- Advisory ·
Document Foundation LibreOffice — GLSA-201908-13
2 records Highest priority Priority HIGH 1 HIGH, 1 LOW
Other records, highest priority first
- TI-2019-07231 LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted'…Priority LOW 25
Show 1 more group
- Advisory ·
Document Foundation LibreOffice — USN-4063-1
2 records Highest priority Priority HIGH 1 HIGH, 1 LOW
Other records, highest priority first
- TI-2019-07231 LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted'…Priority LOW 25
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2020:1151 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2020:1151 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2020:1151 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:1151 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2020:1151 |
Not affected: 1 product
- Red Hat Enterprise Linux 8
Timeline
- 2026-10-02 Threatist record created from CVE-2019-9848
- 2026-10-03 Alias added: GHSA-4vpq-gvj2-8j36
References
Advisory 9
- https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9848
- USN-4063-1
- FEDORA-2019-5561d20558
- GLSA-201908-13
- 20190815 [SECURITY] [DSA 4501-1] libreoffice security update
- FEDORA-2019-2fe22a3a2c
- openSUSE-SU-2019:2057
- openSUSE-SU-2019:2183
- [debian-lts-announce] 20191006 [SECURITY] [DLA 1947-1] libreoffice security update
More The Document Foundation Libreoffice vulnerabilities
- TI-2019-07233 LibreLogo global-event script execution CVSS 3.1CRITICAL 9.8
- TI-2018-12068 Path traversal in [UNKNOWN] libreoffice CVSS 3.0CRITICAL 9.8
- TI-2018-07474 An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache… CVSS 3.0HIGH 7.5
- TI-2018-05018 LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary… CVSS 3.0CRITICAL 9.8
- TI-2023-01118 Arbitrary file write in libreoffice CVSS 3.1MEDIUM 5.5
- TI-2014-02850 Apache OpenOffice before 4.1.1 allows remote attackers to execute arbitrary commands and… CVSS 2.0HIGH 9.3
Sources
- CVE-2019-9848 · CVE Program
- CVE-2019-9848 · NVD
- FIRST EPSS
- GHSA-4vpq-gvj2-8j36 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-9848 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences