Bugzilla – Bug 1146105
VUL-0: CVE-2019-9851: libreoffice: LibreLogo global-event script execution
Last modified: 2020-02-05 07:48:25 UTC
CVE-2019-9851 LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from document event script handers, e.g. mouse over. However LibreOffice also has a separate feature where documents can specify that pre-installed scripts can be executed on various global script events such as document-open, etc. In the fixed versions, global script event handlers are validated equivalently to document script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-9851 http://www.debian.org/security/2019/dsa-4501 http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-9851.html http://www.cvedetails.com/cve/CVE-2019-9851/ http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9851 https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9851
All versions prior 6.2.6 are affected. Based on this all codestreams are affected
This is an autogenerated message for OBS integration: This bug (1146105) was mentioned in https://build.opensuse.org/request/show/724527 Factory / libreoffice
Submissions were done.
SUSE-SU-2019:2231-1: An update that solves 5 vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1133534,1141861,1141862,1146098,1146105,1146107 CVE References: CVE-2019-9848,CVE-2019-9849,CVE-2019-9850,CVE-2019-9851,CVE-2019-9852 Sources used: SUSE Linux Enterprise Workstation Extension 15 (src): libreoffice-6.2.6.2-3.21.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2019:2057-1: An update that solves 5 vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1133534,1141861,1141862,1146098,1146105,1146107 CVE References: CVE-2019-9848,CVE-2019-9849,CVE-2019-9850,CVE-2019-9851,CVE-2019-9852 Sources used: openSUSE Leap 15.0 (src): libreoffice-6.2.6.2-lp150.2.16.1
SUSE-SU-2019:2401-1: An update that solves 7 vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1133534,1141861,1141862,1146098,1146105,1146107,1149943,1149944 CVE References: CVE-2019-9848,CVE-2019-9849,CVE-2019-9850,CVE-2019-9851,CVE-2019-9852,CVE-2019-9854,CVE-2019-9855 Sources used: SUSE Linux Enterprise Workstation Extension 12-SP4 (src): libreoffice-6.2.7.1-43.56.3 SUSE Linux Enterprise Software Development Kit 12-SP4 (src): libreoffice-6.2.7.1-43.56.3 SUSE Linux Enterprise Desktop 12-SP4 (src): libreoffice-6.2.7.1-43.56.3 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2019:2402-1: An update that solves 7 vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1133534,1141861,1141862,1146098,1146105,1146107,1149943,1149944 CVE References: CVE-2019-9848,CVE-2019-9849,CVE-2019-9850,CVE-2019-9851,CVE-2019-9852,CVE-2019-9854,CVE-2019-9855 Sources used: SUSE Linux Enterprise Workstation Extension 15-SP1 (src): libreoffice-6.2.7.1-8.10.1 SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src): libreoffice-6.2.7.1-8.10.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2019:2183-1: An update that solves 7 vulnerabilities and has one errata is now available. Category: security (moderate) Bug References: 1133534,1141861,1141862,1146098,1146105,1146107,1149943,1149944 CVE References: CVE-2019-9848,CVE-2019-9849,CVE-2019-9850,CVE-2019-9851,CVE-2019-9852,CVE-2019-9854,CVE-2019-9855 Sources used: openSUSE Leap 15.1 (src): libreoffice-6.2.7.1-lp151.3.6.1
done