Debian Security Advisory
DLA-1947-1 libreoffice -- LTS security update
- Date Reported:
- 06 Oct 2019
- Affected Packages:
- libreoffice
- Vulnerable:
- Yes
- Security database references:
- In Mitre's CVE dictionary: CVE-2019-9848, CVE-2019-9849, CVE-2019-9850, CVE-2019-9851, CVE-2019-9852, CVE-2019-9853, CVE-2019-9854.
- More information:
-
Several vulnerabilities were discovered in LibreOffice, the office productivity suite.
- CVE-2019-9848
Nils Emmerich discovered that malicious documents could execute arbitrary Python code via LibreLogo.
- CVE-2019-9849
Matei Badanoiu discovered that the stealth mode did not apply to bullet graphics.
- CVE-2019-9850
It was discovered that the protections implemented in CVE-2019-9848 could be bypassed because of insufficient URL validation.
- CVE-2019-9851
Gabriel Masei discovered that malicious documents could execute arbitrary pre-installed scripts.
- CVE-2019-9852
Nils Emmerich discovered that the protection implemented to address CVE-2018-16858 could be bypassed by a URL encoding attack.
- CVE-2019-9853
Nils Emmerich discovered that malicious documents could bypass document security settings to execute macros contained within the document.
- CVE-2019-9854
It was discovered that the protection implemented to address CVE-2019-9852 could be bypassed because of insufficient input sanitization.
For Debian 8
Jessie
, these problems have been fixed in version 1:4.3.3-2+deb8u13.We recommend that you upgrade your libreoffice packages.
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
- CVE-2019-9848