CVE-2019-9853 Insufficient URL decoding flaw in categorizing macro location

What is CVE-2019-9853?

CVE-2019-9853 is a high-severity vulnerability in Libreoffice Libreoffice, published on 27 Sep 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically execution of macros are blocked by default. A URL decoding flaw existed in how the urls to the macros within the document were processed and categorized, resulting in the possibility to construct a document where macro execution bypassed the security settings. The documents were correctly detected as containing macros, and prompted the user to their existence within the documents, but macros within the document were subsequently not controlled by the security settings allowing arbitrary macro execution This issue affects: LibreOffice 6.2 series versions prior to 6.2.7; LibreOffice 6.3 series versions prior to 6.3.1.

Weakness: CWE-116

Which versions are affected by CVE-2019-9853?

It affects 1 product.

Products include Libreoffice Libreoffice.

How do I fix CVE-2019-9853?

Upgrade to a fixed version.

Is CVE-2019-9853 being exploited?

There is no known exploitation of CVE-2019-9853 in the wild and no public exploit code.

Other vulnerabilities in Libreoffice Libreoffice

• CVE-2024-5261 TLS certificate are not properly verified when utilizing LibreOfficeKit Critical 10.0
• CVE-2019-9855 Windows 8.3 path equivalence handling flaw allows LibreLogo script execution Critical 9.8
• CVE-2018-14939 Memory corruption in n/a Critical 9.8
• CVE-2017-8358 Memory corruption in n/a Critical 9.8
• CVE-2017-7882 Memory corruption in n/a Critical 9.8

All Libreoffice Libreoffice vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2019-9853, GHSA-52vw-wff4-8w2j, SUSE-SU-2020:0121-1, SUSE-SU-2020:0372-1, UBUNTU-CVE-2019-9853, openSUSE-SU-2019:2709-1.