CVE-2019-9855 Windows 8.3 path equivalence handling flaw allows LibreLogo script execution

What is CVE-2019-9855?

CVE-2019-9855 is a critical vulnerability in Libreoffice Libreoffice, published on 6 Sep 2019.

Official description

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc. Protection was added to block calling LibreLogo from script event handers. However a Windows 8.3 path equivalence handling flaw left LibreOffice vulnerable under Windows that a document could trigger executing LibreLogo via a Windows filename pseudonym. This issue affects: Document Foundation LibreOffice 6.2 versions prior to 6.2.7; 6.3 versions prior to 6.3.1.

Weakness: CWE-417

Which versions are affected by CVE-2019-9855?

It affects 2 products.

Products include Libreoffice Libreoffice, Opensuse Leap.

How do I fix CVE-2019-9855?

Upgrade to a fixed version.

Is CVE-2019-9855 being exploited?

There is no known exploitation of CVE-2019-9855 in the wild and no public exploit code.

Other vulnerabilities in Libreoffice Libreoffice

• CVE-2024-5261 TLS certificate are not properly verified when utilizing LibreOfficeKit Critical 10.0
• CVE-2018-14939 Memory corruption in n/a Critical 9.8
• CVE-2017-8358 Memory corruption in n/a Critical 9.8
• CVE-2017-7882 Memory corruption in n/a Critical 9.8
• CVE-2016-10327 Memory corruption in n/a Critical 9.8

All Libreoffice Libreoffice vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-873f-q5vx-w7hm.