PT-2019-2074 · Document Foundation · Libreoffice

Zhongcheng Li · Published 2019-05-08 · Updated 2021-09-08 · CVE-2019-9847

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibreOffice versions prior to 6.1.6 LibreOffice versions 6.2 series prior to 6.2.3

Description The issue exists due to insufficient input validation in LibreOffice's hyperlink processing, allowing an attacker to construct documents with hyperlinks that point to an executable on the target user's file system. If the hyperlink is activated, the executable target is launched unconditionally. This affects the confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 6.1.6, update to version 6.1.6 or later. For versions 6.2 series prior to 6.2.3, update to version 6.2.3 or later. As a temporary workaround, consider avoiding the use of hyperlinks in LibreOffice documents until a patch is applied.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2019-01820

CVE-2019-9847

Affected Products

Libreoffice

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-9847 · Security Note
• https://libreoffice.org/about-us/security/advisories/cve-2019-9847 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-9847 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01820 · Security Note