Homepage

Improper Input Validation The advisory has been revoked - it doesn't affect any version of package libreoffice-sdk-doc  (opens in a new tab)

Threat Intelligence

EPSS
2.93% (87th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-SLES151-LIBREOFFICESDKDOC-2735203
  • published14 Apr 2022
  • disclosed18 Sept 2019
Report a new vulnerability Found a mistake?

Introduced: 18 Sep 2019

CVE-2019-9850  (opens in a new tab)
CWE-20  (opens in a new tab)

Amendment

The SLES security team deemed this advisory irrelevant for SLES:15.1.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libreoffice-sdk-doc package and not the libreoffice-sdk-doc package as distributed by SLES.

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from script event handers. However an insufficient url validation vulnerability in LibreOffice allowed malicious to bypass that protection and again trigger calling LibreLogo from script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.

References