PT-2019-2074 · Document Foundation · Libreoffice

Zhongcheng Li · Publicado 2019-05-08 · Atualizado 2021-09-08 · CVE-2019-9847

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibreOffice versions prior to 6.1.6 LibreOffice versions 6.2 series prior to 6.2.3

Description The issue exists due to insufficient input validation in LibreOffice's hyperlink processing, allowing an attacker to construct documents with hyperlinks that point to an executable on the target user's file system. If the hyperlink is activated, the executable target is launched unconditionally. This affects the confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 6.1.6, update to version 6.1.6 or later. For versions 6.2 series prior to 6.2.3, update to version 6.2.3 or later. As a temporary workaround, consider avoiding the use of hyperlinks in LibreOffice documents until a patch is applied.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2019-01820

CVE-2019-9847

Produtos afetados

Libreoffice

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-9847 · Nota de Segurança
• https://libreoffice.org/about-us/security/advisories/cve-2019-9847 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-9847 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-01820 · Nota de Segurança