Insufficient url validation allowing LibreLogo script execution
Priority MEDIUM 47CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 7 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.
Summary
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from script event handers. However an insufficient url validation vulnerability in LibreOffice allowed malicious to bypass that protection and again trigger calling LibreLogo from script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.
Why it matters now
EPSS 0.02928 87th percentileScored 2026-11-07
Fix Partial LibreOffice (Document Foundation): 6.2.6Red Hat: 2 advisoriesRed Hat: 7 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| The Document Foundation | LibreOffice | before 6.2.6 | 6.2.6 | Patch available | CNA |
- LibreOffice VendorThe Document Foundation Affected before 6.2.6 Fixed in 6.2.6 Patch available CNA
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* | 19.04 | Vulnerable | Canonical |
| cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* | 29 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:* Versions 29 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
Show 1 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:* | before 6.2.6 | Vulnerable | The Document Foundation |
- cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:* Versions before 6.2.6 Vulnerable ·The Document Foundation
Remediation
- Fix · CNA LibreOffice (Document Foundation) Fixed in 6.2.6
Red Hat 2 advisories
- RHSA-2020:1598 Released 2020-04-28 · Red Hat rating Moderatelibreoffice security and bug fix update
- Red Hat CodeReady Linux Builder (v. 8) libreoffice-gtk2-1:6.0.6.1-20.el8, libreoffice-sdk-1:6.0.6.1-20.el8, libreoffice-sdk-doc-1:6.0.6.1-20.el8 +1
- Red Hat Enterprise Linux AppStream (v. 8) autocorr-af-1:6.0.6.1-20.el8, autocorr-bg-1:6.0.6.1-20.el8, autocorr-ca-1:6.0.6.1-20.el8 +47
- RHSA-2020:1151 Released 2020-03-31 · Red Hat rating Moderatelibreoffice security and bug fix update
- Red Hat Enterprise Linux Client (v. 7) autocorr-af-1:5.3.6.1-24.el7, autocorr-bg-1:5.3.6.1-24.el7, autocorr-ca-1:5.3.6.1-24.el7 +47
- Red Hat Enterprise Linux Client Optional (v. 7) libreoffice-1:5.3.6.1-24.el7, libreoffice-bsh-1:5.3.6.1-24.el7, libreoffice-gdb-debug-support-1:5.3.6.1-24.el7 +47
- Red Hat Enterprise Linux Server Optional (v. 7) autocorr-af-1:5.3.6.1-24.el7, autocorr-bg-1:5.3.6.1-24.el7, autocorr-ca-1:5.3.6.1-24.el7 +47
- Red Hat Enterprise Linux Workstation (v. 7) autocorr-af-1:5.3.6.1-24.el7, autocorr-bg-1:5.3.6.1-24.el7, autocorr-ca-1:5.3.6.1-24.el7 +47
- Red Hat Enterprise Linux Workstation Optional (v. 7) libreoffice-1:5.3.6.1-24.el7, libreoffice-bsh-1:5.3.6.1-24.el7, libreoffice-gdb-debug-support-1:5.3.6.1-24.el7 +47
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Document Foundation LibreOffice — USN-4102-1
3 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2019-07233 LibreLogo global-event script executionPriority HIGH 82
- TI-2019-07234 Insufficient URL encoding flaw in allowed script location checkPriority LOW 38
- Advisory ·
Document Foundation LibreOffice — DSA-4501
3 records Highest priority Priority HIGH 1 HIGH, 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2019-07233 LibreLogo global-event script executionPriority HIGH 82
- TI-2019-07234 Insufficient URL encoding flaw in allowed script location checkPriority LOW 38
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat CodeReady Linux Builder (v. 8) | Fixed | RHSA-2020:1598 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2020:1598 |
| Red Hat Enterprise Linux Client (v. 7) | Fixed | RHSA-2020:1151 |
| Red Hat Enterprise Linux Client Optional (v. 7) | Fixed | RHSA-2020:1151 |
| Red Hat Enterprise Linux Server Optional (v. 7) | Fixed | RHSA-2020:1151 |
| Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2020:1151 |
| Red Hat Enterprise Linux Workstation Optional (v. 7) | Fixed | RHSA-2020:1151 |
Timeline
- 2026-10-02 Threatist record created from CVE-2019-9850
- 2026-10-03 Alias added: GHSA-vq62-85wx-mmv3
References
Advisory 9
- https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9850
- 20190815 [SECURITY] [DSA 4501-1] libreoffice security update
- DSA-4501
- FEDORA-2019-dd9d207c17
- FEDORA-2019-2fe22a3a2c
- USN-4102-1
- openSUSE-SU-2019:2057
- openSUSE-SU-2019:2183
- [debian-lts-announce] 20191006 [SECURITY] [DLA 1947-1] libreoffice security update
More The Document Foundation Libreoffice vulnerabilities
- TI-2019-07233 LibreLogo global-event script execution CVSS 3.1CRITICAL 9.8
- TI-2018-12068 Path traversal in [UNKNOWN] libreoffice CVSS 3.0CRITICAL 9.8
- TI-2018-07474 An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache… CVSS 3.0HIGH 7.5
- TI-2019-07230 Code injection in Document Foundation LibreOffice CVSS 3.1CRITICAL 9.8
- TI-2018-05018 LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary… CVSS 3.0CRITICAL 9.8
- TI-2023-01118 Arbitrary file write in libreoffice CVSS 3.1MEDIUM 5.5
Sources
- CVE-2019-9850 · CVE Program
- CVE-2019-9850 · NVD
- FIRST EPSS
- GHSA-vq62-85wx-mmv3 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-9850 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences