UBUNTU-CVE-2019-9848

    Dashboard / Vulnerabilities / UBUNTU-CVE-2019-9848

    UBUNTU-CVE-2019-9848

    Published: 16 Jul 2019Last Modified: 22 Apr 2026
    Upstream:
    CVE-2019-9848
    Aliases:
    USN-4063-1

    Summary:

    Details: LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. LibreOffice is typically also bundled with LibreLogo, a programmable turtle vector graphics script, which can be manipulated into executing arbitrary python commands. By using the document event feature to trigger LibreLogo to execute python contained within a document a malicious document could be constructed which would execute arbitrary python commands silently without warning. In the fixed versions, LibreLogo cannot be called from a document event handler. This issue affects: Document Foundation LibreOffice versions prior to 6.2.5.

    References: https://ubuntu.com/security/CVE-2019-9848, https://www.libreoffice.org/about-us/security/advisories/cve-2019-9848/, https://ubuntu.com/security/notices/USN-4063-1, https://www.cve.org/CVERecord?id=CVE-2019-9848

    Affected packages

    Package

    Name: libreoffice

    Purl: pkg:deb/ubuntu/libreoffice@1:5.1.6~rc2-0ubuntu1~xenial8?arch=source&distro=xenial

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1:5.1.6~rc2-0ubuntu1~xenial8

    Affected versions

    1:5.0.2-0ubuntu1
    1:5.0.2-0ubuntu2
    1:5.0.2-0ubuntu5
    1:5.0.2-0ubuntu7
    1:5.0.2-0ubuntu8

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2019-9848 | CVE-DB