CVE-2019-9855

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-9855
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-9855.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2019-9855
Downstream
Related
Published
2019-09-06T19:15:12.073Z
Modified
2026-04-11T12:23:58.885719Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc. Protection was added to block calling LibreLogo from script event handers. However a Windows 8.3 path equivalence handling flaw left LibreOffice vulnerable under Windows that a document could trigger executing LibreLogo via a Windows filename pseudonym. This issue affects: Document Foundation LibreOffice 6.2 versions prior to 6.2.7; 6.3 versions prior to 6.3.1.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "introduced": "6.3.0"
                },
                {
                    "fixed": "6.3.1"
                }
            ],
            "cpe": "cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*"
        },
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "15.0"
                }
            ],
            "cpe": "cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*"
        },
        {
            "source": "CPE_FIELD",
            "extracted_events": [
                {
                    "last_affected": "15.1"
                }
            ],
            "cpe": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
        }
    ]
}
References

Affected packages

Git / github.com/libreoffice/core

Affected ranges

Type
GIT
Repo
https://github.com/libreoffice/core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a7004eb475ad8836d2e5c783805e32323b86cbe6
Database specific 
{
    "source": "CPE_FIELD",
    "extracted_events": [
        {
            "introduced": "6.2.0"
        },
        {
            "fixed": "6.2.7"
        }
    ],
    "cpe": "cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:*"
}

Affected versions

CODE-4.*
CODE-4.2.0-1
CODE-4.2.0-2
CODE-4.2.0-3
CODE-4.2.0-4
CP-Android-iOS-4.*
CP-Android-iOS-4.2.0
Other
MELD_LIBREOFFICE_REPOS
libreoffice-3-5-branch-point
libreoffice-3-6-branch-point
libreoffice-4-0-branch-point
libreoffice-4-1-branch-point
libreoffice-4-2-branch-point
libreoffice-4-2-milestone-1
libreoffice-4-3-branch-point
libreoffice-4-4-branch-point
libreoffice-5-0-branch-point
libreoffice-5-1-branch-point
libreoffice-5-2-branch-point
libreoffice-5-3-branch-point
libreoffice-5-4-branch-point
libreoffice-6-0-branch-point
libreoffice-6-1-branch-point
libreoffice-6-2-branch-point
windows_build_successful_2011_11_08
co-6.*
co-6.2-1
co-6.2-2
cp-6.*
cp-6.2-3
cp-6.2-4
cp-6.2-5
cp-6.2-branch-point
gpg4libre-review-5.*
gpg4libre-review-5.4.99
libreoffice-3.*
libreoffice-3.5.0.0
sdremote-2.*
sdremote-2.0.0

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-9855.json"