Bug 1149943 - (CVE-2019-9855) VUL-0: CVE-2019-9855: libreoffice: Windows 8.3 path equivalence handling flaw allows LibreLogo script execution
(CVE-2019-9855)
VUL-0: CVE-2019-9855: libreoffice: Windows 8.3 path equivalence handling flaw...
Status: RESOLVED INVALID
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P5 - None : Major
: ---
Assigned To: Tomáš Chvátal
Security Team bot
https://smash.suse.de/issue/241925/
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2019-09-09 07:40 UTC by Alexandros Toptsoglou
Modified: 2020-01-17 07:39 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alexandros Toptsoglou 2019-09-09 07:40:44 UTC
CVE-2019-9855

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector
graphics script, which can execute arbitrary python commands contained with the
document it is launched from. LibreOffice also has a feature where documents can
specify that pre-installed scripts can be executed on various document script
events such as mouse-over, etc. Protection was added to block calling LibreLogo
from script event handers. However a Windows 8.3 path equivalence handling flaw
left LibreOffice vulnerable under Windows that a document could trigger
executing LibreLogo via a Windows filename pseudonym. This issue affects:
Document Foundation LibreOffice 6.2 versions prior to 6.2.7; 6.3 versions prior
to 6.3.1.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-9855
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-9855.html
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9855
http://www.cvedetails.com/cve/CVE-2019-9855/
https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9855/
Comment 1 Alexandros Toptsoglou 2019-09-09 07:41:36 UTC
This is Windows specific. Closing as invalid
Comment 3 Swamp Workflow Management 2019-09-09 14:30:06 UTC
This is an autogenerated message for OBS integration:
This bug (1149943) was mentioned in
https://build.opensuse.org/request/show/729479 Factory / libreoffice
Comment 4 Swamp Workflow Management 2019-09-18 16:13:16 UTC
SUSE-SU-2019:2401-1: An update that solves 7 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1133534,1141861,1141862,1146098,1146105,1146107,1149943,1149944
CVE References: CVE-2019-9848,CVE-2019-9849,CVE-2019-9850,CVE-2019-9851,CVE-2019-9852,CVE-2019-9854,CVE-2019-9855
Sources used:
SUSE Linux Enterprise Workstation Extension 12-SP4 (src):    libreoffice-6.2.7.1-43.56.3
SUSE Linux Enterprise Software Development Kit 12-SP4 (src):    libreoffice-6.2.7.1-43.56.3
SUSE Linux Enterprise Desktop 12-SP4 (src):    libreoffice-6.2.7.1-43.56.3

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 5 Swamp Workflow Management 2019-09-18 16:15:35 UTC
SUSE-SU-2019:2402-1: An update that solves 7 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1133534,1141861,1141862,1146098,1146105,1146107,1149943,1149944
CVE References: CVE-2019-9848,CVE-2019-9849,CVE-2019-9850,CVE-2019-9851,CVE-2019-9852,CVE-2019-9854,CVE-2019-9855
Sources used:
SUSE Linux Enterprise Workstation Extension 15-SP1 (src):    libreoffice-6.2.7.1-8.10.1
SUSE Linux Enterprise Module for Open Buildservice Development Tools 15-SP1 (src):    libreoffice-6.2.7.1-8.10.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 6 Swamp Workflow Management 2019-09-19 09:24:54 UTC
This is an autogenerated message for OBS integration:
This bug (1149943) was mentioned in
https://build.opensuse.org/request/show/731894 Factory / libreoffice
Comment 7 Swamp Workflow Management 2019-09-25 10:11:30 UTC
openSUSE-SU-2019:2183-1: An update that solves 7 vulnerabilities and has one errata is now available.

Category: security (moderate)
Bug References: 1133534,1141861,1141862,1146098,1146105,1146107,1149943,1149944
CVE References: CVE-2019-9848,CVE-2019-9849,CVE-2019-9850,CVE-2019-9851,CVE-2019-9852,CVE-2019-9854,CVE-2019-9855
Sources used:
openSUSE Leap 15.1 (src):    libreoffice-6.2.7.1-lp151.3.6.1
Comment 8 Swamp Workflow Management 2019-10-16 19:20:39 UTC
SUSE-SU-2019:2686-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1149943,1149944
CVE References: CVE-2019-9854,CVE-2019-9855
Sources used:
SUSE Linux Enterprise Workstation Extension 15 (src):    libreoffice-6.2.7.1-3.24.4

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 9 Swamp Workflow Management 2019-10-22 04:10:53 UTC
openSUSE-SU-2019:2361-1: An update that fixes two vulnerabilities is now available.

Category: security (moderate)
Bug References: 1149943,1149944
CVE References: CVE-2019-9854,CVE-2019-9855
Sources used:
openSUSE Leap 15.0 (src):    libreoffice-6.2.7.1-lp150.2.19.1