CVSS: 9.8EPSS: 17%CPEs: 9EXPL: 0CVE-2019-9848 – libreoffice: LibreLogo script can be manipulated into executing arbitrary python commands
https://notcve.org/view.php?id=CVE-2019-9848
LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc. LibreOffice is typically also bundled with LibreLogo, a programmable turtle vector graphics script, which can be manipulated into executing arbitrary python commands. By using the document event feature to trigger LibreLogo to execute python contained within a document a malicious document could be constructed which would execute arbitrary python commands silently without warning. In the fixed versions, LibreLogo cannot be called from a document event handler. This issue affects: Document Foundation LibreOffice versions prior to 6.2.5. • http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00006.html http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.html http://www.securityfocus.com/bid/109374 https://lists.debian.org/debian-lts-announce/2019/10/msg00005.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PMEGUWMWORC3DOVEHVXLFT3A5RSCMLBH https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPTZJCNN52VNGSVC5DFKVW3EDMRDWKMP https://seclists.org&#x • CWE-20: Improper Input Validation CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-9847 – Executable hyperlink targets executed unconditionally on activation
https://notcve.org/view.php?id=CVE-2019-9847
A vulnerability in LibreOffice hyperlink processing allows an attacker to construct documents containing hyperlinks pointing to the location of an executable on the target users file system. If the hyperlink is activated by the victim the executable target is unconditionally launched. Under Windows and macOS when processing a hyperlink target explicitly activated by the user there was no judgment made on whether the target was an executable file, so such executable targets were launched unconditionally. This issue affects: All LibreOffice Windows and macOS versions prior to 6.1.6; LibreOffice Windows and macOS versions in the 6.2 series prior to 6.2.3. Una vulnerabilidad en el procesamiento de hipervínculos de LibreOffice permite a un atacante construir documentos que contengan hipervínculos que apunten a la ubicación de un ejecutable en el sistema de archivos de los usuarios victimas. • https://www.libreoffice.org/about-us/security/advisories/cve-2019-9847 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 96%CPEs: 2EXPL: 4CVE-2018-16858 – LibreOffice < 6.0.7 / 6.1.3 - Macro Code Execution
https://notcve.org/view.php?id=CVE-2018-16858
It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. An attacker could craft a document, which when opened by LibreOffice, would execute a Python method from a script in any arbitrary file system location, specified relative to the LibreOffice install location. Se ha observado que libreoffice en versiones anteriores a la 6.0.7 y 6.1.3 era vulnerable a ataques de salto de directorio que podrían ser usados para ejecutar macros arbitrarios incluidos en un documento. Un atacante podría manipular un documento que, al ser abierto por LibreOffice, ejecute un método Python desde un script en cualquier ubicación arbitrara del sistema de archivos, especificada de forma relativa a la ubicación de instalación de LibreOffice. It was found that libreoffice was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. • https://www.exploit-db.com/exploits/46727 https://github.com/Henryisnotavailable/CVE-2018-16858-Python https://github.com/bantu2301/CVE-2018-16858 http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00059.html http://packetstormsecurity.com/files/152560/LibreOffice-Macro-Code-Execution.html http://www.rapid7.com/db/modules/exploit/multi/fileformat/libreoffice_macro_exec https://access.redhat.com/errata/RHSA-2019:2130 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16858 https:& • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-356: Product UI does not Warn User of Unsafe Actions •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2018-14939
https://notcve.org/view.php?id=CVE-2018-14939
The get_app_path function in desktop/unx/source/start.c in LibreOffice through 6.0.5 mishandles the realpath function in certain environments such as FreeBSD libc, which might allow attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact if LibreOffice is automatically launched during web browsing with pathnames controlled by a remote web site. La función get_app_path en desktop/unx/source/start.c en LibreOffice hasta la versión 6.0.5 gestiona de manera incorrecta la función realpath en ciertos entornos, como FreeBSD libc, lo que podría permitir que atacantes provoquen una denegación de servicio (desbordamiento de búfer y cierre inesperado de la aplicación) o, posiblemente, otro tipo de impacto sin especificar si se inicia automáticamente LibreOffice durante la navegación web con nombres de ruta controlados por un sitio web remoto. • http://www.securityfocus.com/bid/105047 https://bugs.documentfoundation.org/show_bug.cgi?id=118514 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 31%CPEs: 10EXPL: 4CVE-2018-10583 – LibreOffice/Open Office - '.odt' Information Disclosure
https://notcve.org/view.php?id=CVE-2018-10583
An information disclosure vulnerability occurs when LibreOffice 6.0.3 and Apache OpenOffice Writer 4.1.5 automatically process and initiate an SMB connection embedded in a malicious file, as demonstrated by xlink:href=file://192.168.0.2/test.jpg within an office:document-content element in a .odt XML document. Ocurre una vulnerabilidad de divulgación de información cuando LibreOffice 6.0.3 y Apache OpenOffice Writer 4.1.5 procesan automáticamente e inician una conexión SMB embebida en un archivo malicioso, tal y como queda demostrado con xlink:href=file://192.168.0.2/test.jpg en un elemento office:document-content en un documento XML .odt. Generates a Malicious ODT File which can be used with auxiliary/server/capture/smb or similar to capture hashes. • https://www.exploit-db.com/exploits/44564 https://github.com/MrTaherAmine/CVE-2018-10583 https://github.com/octodi/CVE-2018-10583 http://seclists.org/fulldisclosure/2020/Oct/26 http://secureyourit.co.uk/wp/2018/05/01/creating-malicious-odt-files https://access.redhat.com/errata/RHSA-2018:3054 https://lists.apache.org/thread.html/0598708912978b27121b2e380b44a225c706aca882cd1da6a955a0af%40%3Cdev.openoffice.apache.org%3E https://lists.apache.org/thread.html/6c65f22306c36c95e75f8d2b7f49cfcbeb0a4614245c20934612a39d%40%3Cde • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •