Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Advisory: Document Foundation LibreOffice — DSA-4501 Clear all filters
TI-2019-07234 CVE-2019-9852 · GHSA-vgrf-j225-8963

Insufficient URL encoding flaw in allowed script location check

Priority LOW 38

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01752 Published 2019-08-15 Partial fix · 6.2.6 CWE-116
TI-2019-07233 CVE-2019-9851 · GHSA-2rm2-3r73-2vfr

LibreLogo global-event script execution

Priority HIGH 82

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.77837 Published 2019-08-15 Partial fix · 6.2.6 CWE-20
TI-2019-07232 CVE-2019-9850 · GHSA-vq62-85wx-mmv3

Insufficient url validation allowing LibreLogo script execution

Priority MEDIUM 47

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02928 Published 2019-08-15 Partial fix · 6.2.6 CWE-20