This update for libreoffice fixes the following issues :

Updated to version 6.2.7.1.

Security issues fixed :

CVE-2019-9849: Disabled fetching remote bullet graphics in 'stealth mode' (bsc#1141861).

CVE-2019-9848: Fixed an arbitrary script execution via LibreLogo (bsc#1141862).

CVE-2019-9851: Fixed LibreLogo global-event script execution issue (bsc#1146105).

CVE-2019-9852: Fixed insufficient URL encoding flaw in allowed script location check (bsc#1146107).

CVE-2019-9850: Fixed insufficient URL validation that allowed LibreLogo script execution (bsc#1146098).

CVE-2019-9854: Fixed unsafe URL assembly flaw (bsc#1149944).

CVE-2019-9855: Fixed path equivalence handling flaw (bsc#1149943)

Non-security issue fixed: SmartArt: Basic rendering of Trapezoid List (bsc#1133534).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libreoffice fixes the following issues :

Updated to version 6.2.7.1.

Security issues fixed :

  - CVE-2019-9849: Disabled fetching remote bullet graphics     in 'stealth mode' (bsc#1141861).

  - CVE-2019-9848: Fixed an arbitrary script execution via     LibreLogo (bsc#1141862).

  - CVE-2019-9851: Fixed LibreLogo global-event script     execution issue (bsc#1146105).

  - CVE-2019-9852: Fixed insufficient URL encoding flaw in     allowed script location check (bsc#1146107).

  - CVE-2019-9850: Fixed insufficient URL validation that     allowed LibreLogo script execution (bsc#1146098).

  - CVE-2019-9854: Fixed unsafe URL assembly flaw     (bsc#1149944).

  - CVE-2019-9855: Fixed path equivalence handling flaw     (bsc#1149943)

Non-security issue fixed :

  - SmartArt: Basic rendering of Trapezoid List     (bsc#1133534).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for libreoffice fixes the following issues: &#9; Updated to version 6.2.7.1.

Security issues fixed :

  - CVE-2019-9854: Fixed unsafe URL assembly flaw     (bsc#1149944).

  - CVE-2019-9855: Fixed path equivalence handling flaw     (bsc#1149943)

This update was imported from the SUSE:SLE-15:Update update project.

This update for libreoffice to version 6.2.7.1 fixes the following issues :

Security issues fixed :

CVE-2019-9849: Disabled fetching remote bullet graphics in 'stealth mode' (bsc#1141861).

CVE-2019-9848: Fixed an arbitrary script execution via LibreLogo (bsc#1141862).

CVE-2019-9851: Fixed LibreLogo global-event script execution issue (bsc#1146105).

CVE-2019-9852: Fixed insufficient URL encoding flaw in allowed script location check (bsc#1146107).

CVE-2019-9850: Fixed insufficient URL validation that allowed LibreLogo script execution (bsc#1146098).

CVE-2019-9854: Fixed unsafe URL assembly flaw (bsc#1149944).

CVE-2019-9855: Fixed path equivalence handling flaw (bsc#1149943)

Non-security issue fixed: SmartArt: Basic rendering of Trapezoid List (bsc#1133534)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of LibreOffice installed on the remote Windows host is prior to 6.2.7 or 6.3.x prior to 6.3.1. It is, therefore, affected by the following vulnerabilities:

  - A directory traversal vulnerability resulting from a feature in LibreOffice which allows documents to     specify pre-installed macros that can be executed on various script events. Only scripts under the     'share/Scripts/python' and /user/Scripts/python' sub-directories of the LibreOffice install should be     accessible. Previous protection to address CVE-2019-9852 to avoid a similar attack was added, however this     protection can be bypassed due to a flaw in how LibreOffice assembles the final script URL location. This     flaw can be exploited to allow scripts in arbitrary locations on the file system to be executed.     (CVE-2019-9854)

  - An arbitrary script execution vulnerability caused by a flaw allowing event-based execution of Python     scripts within a document. Previous protection was added to address this flaw, however due to a Windows     8.3 path equivalence flaw, Windows systems are still vulnerable via Windows filename pseudonyms. Note,     LibreLogo must be installed for this vulnerability to be exploitable, however LibreLogo is frequently     bundled with LibreOffice. (CVE-2019-9855)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
129046	SUSE SLED15 / SLES15 Security Update : libreoffice (SUSE-SU-2019:2402-1)	Nessus	SuSE Local Security Checks	9/19/2019	4/24/2024	critical
129346	openSUSE Security Update : libreoffice (openSUSE-2019-2183)	Nessus	SuSE Local Security Checks	9/25/2019	4/23/2024	critical
130143	openSUSE Security Update : libreoffice (openSUSE-2019-2361)	Nessus	SuSE Local Security Checks	10/22/2019	4/17/2024	critical
129045	SUSE SLED12 Security Update : libreoffice (SUSE-SU-2019:2401-1)	Nessus	SuSE Local Security Checks	9/19/2019	4/24/2024	critical
129535	LibreOffice < 6.2.7 / 6.3.x < 6.3.1 Multiple Vulnerabilities (Windows)	Nessus	Windows	10/3/2019	4/19/2024	critical

Detections

Analytics

Plugins Search

critical

critical

critical

critical

critical