vulnerability

Huawei EulerOS: CVE-2019-9850: libreoffice security update

Severity
8
CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Published
Aug 15, 2019
Added
Sep 24, 2019
Modified
Apr 1, 2026

Description

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from script event handers. However an insufficient url validation vulnerability in LibreOffice allowed malicious to bypass that protection and again trigger calling LibreLogo from script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.

Solutions

huawei-euleros-2_0_sp5-upgrade-autocorr-enhuawei-euleros-2_0_sp5-upgrade-libreoffice-calchuawei-euleros-2_0_sp5-upgrade-libreoffice-corehuawei-euleros-2_0_sp5-upgrade-libreoffice-datahuawei-euleros-2_0_sp5-upgrade-libreoffice-drawhuawei-euleros-2_0_sp5-upgrade-libreoffice-filtershuawei-euleros-2_0_sp5-upgrade-libreoffice-graphicfilterhuawei-euleros-2_0_sp5-upgrade-libreoffice-gtk2huawei-euleros-2_0_sp5-upgrade-libreoffice-gtk3huawei-euleros-2_0_sp5-upgrade-libreoffice-impresshuawei-euleros-2_0_sp5-upgrade-libreoffice-langpack-enhuawei-euleros-2_0_sp5-upgrade-libreoffice-mathhuawei-euleros-2_0_sp5-upgrade-libreoffice-opensymbol-fontshuawei-euleros-2_0_sp5-upgrade-libreoffice-pdfimporthuawei-euleros-2_0_sp5-upgrade-libreoffice-pyunohuawei-euleros-2_0_sp5-upgrade-libreoffice-urehuawei-euleros-2_0_sp5-upgrade-libreoffice-ure-commonhuawei-euleros-2_0_sp5-upgrade-libreoffice-writerhuawei-euleros-2_0_sp5-upgrade-libreoffice-x11huawei-euleros-2_0_sp5-upgrade-libreoffice-xsltfilterhuawei-euleros-2_0_sp5-upgrade-libreofficekit
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.