{"schemaVersion":3,"id":"CVE-2019-9854","aliases":["UBUNTU-CVE-2019-9854","USN-4138-1","DEBIAN-CVE-2019-9854","DSA-4519-1"],"status":"published","duplicateOf":null,"title":null,"description":"LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice install. Protection was added, to address CVE-2019-9852, to avoid a directory traversal attack where scripts in arbitrary locations on the file system could be executed by employing a URL encoding attack to defeat the path verification step. However this protection could be bypassed by taking advantage of a flaw in how LibreOffice assembled the final script URL location directly from components of the passed in path as opposed to solely from the sanitized output of the path verification step. This issue affects: Document Foundation LibreOffice 6.2 versions prior to 6.2.7; 6.3 versions prior to 6.3.1.","dates":{"published":"2019-09-06T18:30:08.910Z","modified":"2024-09-16T19:24:19.650Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":4.6,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":4.6,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.01756,"percentile":0.77611,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":-0.1740000000000002,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.0193},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01756,"percentile":0.77611}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0193,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.01756,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.01756,"percentile":0.77611}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"canonical","product":"ubuntu_linux","name":"ubuntu linux","label":"ubuntu_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"16.04","noFixRecorded":false,"fixedIn":null},{"text":"18.04","noFixRecorded":false,"fixedIn":null},{"text":"19.04","noFixRecorded":false,"fixedIn":null}],"versionsText":"16.04 | 18.04 | 19.04","eol":{"isEol":true,"eolDate":"2021-04-02T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"16.04","label":"16.04 'Xenial Xerus' (LTS)","eolFrom":"2021-04-02T00:00:00.000Z","isLts":true,"isMaintained":false,"latestVersion":"16.04.7"},"product":{"name":"ubuntu","label":"Ubuntu","category":"os"}},"hubHref":"/vendor/canonical/ubuntu_linux"},{"vendor":"debian","product":"libreoffice","name":"libreoffice","label":"libreoffice","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/libreoffice","purlType":"deb","versions":[{"text":"< 1:6.3.1~rc2-1","noFixRecorded":false,"fixedIn":null},{"text":"< 1:5.2.7-1+deb9u11","noFixRecorded":false,"fixedIn":null},{"text":"< 1:6.1.5-3+deb10u4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1:6.3.1~rc2-1 | < 1:5.2.7-1+deb9u11 | < 1:6.1.5-3+deb10u4","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"libreoffice","name":"libreoffice","label":"libreoffice","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/libreoffice","purlType":"deb","versions":[{"text":"< 1:5.1.6~rc2-0ubuntu1~xenial10","noFixRecorded":false,"fixedIn":null},{"text":"< 1:6.0.7-0ubuntu0.18.04.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1:5.1.6~rc2-0ubuntu1~xenial10 | < 1:6.0.7-0ubuntu0.18.04.10","eol":null,"hubHref":null},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"8.0","noFixRecorded":false,"fixedIn":null},{"text":"9.0","noFixRecorded":false,"fixedIn":null},{"text":"10.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"8.0 | 9.0 | 10.0","eol":{"isEol":true,"eolDate":"2020-06-30T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"8","label":"8 (Jessie)","eolFrom":"2020-06-30T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"8.11"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"document foundation","product":"libreoffice","name":"LibreOffice","label":"libreoffice","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 6.2, < 6.2.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.3, < 6.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 6.2, < 6.2.7 | ≥ 6.3, < 6.3.1","eol":null,"hubHref":"/vendor/document_foundation/libreoffice"},{"vendor":"fedoraproject","product":"fedora","name":"fedora","label":"fedora","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"29","noFixRecorded":false,"fixedIn":null}],"versionsText":"29","eol":{"isEol":true,"eolDate":"2019-11-26T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"29","label":"29","eolFrom":"2019-11-26T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"fedora","label":"Fedora Linux","category":"os"}},"hubHref":"/vendor/fedoraproject/fedora"},{"vendor":"libreoffice","product":"libreoffice","name":"libreoffice","label":"libreoffice","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 6.2.0, < 6.2.7","noFixRecorded":false,"fixedIn":null},{"text":"≥ 6.3.0, < 6.3.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 6.2.0, < 6.2.7 | ≥ 6.3.0, < 6.3.1","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"libreoffice","label":"LibreOffice","category":"app"}},"hubHref":"/vendor/libreoffice/libreoffice"},{"vendor":"opensuse","product":"leap","name":"leap","label":"leap","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"15.0","noFixRecorded":false,"fixedIn":null},{"text":"15.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"15.0 | 15.1","eol":{"isEol":true,"eolDate":"2019-12-03T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"15.0","label":"Leap 15.0","eolFrom":"2019-12-03T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"opensuse","label":"openSUSE","category":"os"}},"hubHref":"/vendor/opensuse/leap"},{"vendor":"redhat","product":"enterprise_linux","name":"enterprise linux","label":"enterprise_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"7.0","noFixRecorded":false,"fixedIn":null},{"text":"8.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.0 | 8.0","eol":{"isEol":true,"eolDate":"2024-06-30T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"7","label":"7 (ELS)","eolFrom":"2024-06-30T00:00:00.000Z","isLts":true,"isMaintained":true,"latestVersion":"7.9"},"product":{"name":"rhel","label":"Red Hat Enterprise Linux","category":"os"}},"hubHref":"/vendor/redhat/enterprise_linux"}],"affectedCount":9,"eol":{"hasEol":true,"count":5},"references":[{"url":"https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9854/","label":"www.libreoffice.org/about-us/security/advisories/CVE-2019-9854/","hostname":"www.libreoffice.org","tags":["X Refsource CONFIRM","REPORT","Vendor Advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4519","label":"www.debian.org/security/2019/dsa-4519","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"https://seclists.org/bugtraq/2019/Sep/17","label":"seclists.org/bugtraq/2019/Sep/17","hostname":"seclists.org","tags":["Mailing List","X Refsource BUGTRAQ","Third Party Advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQKKOIY2DMZCXJINOLIQXD2NWISDKK3N/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["Vendor Advisory","X Refsource FEDORA"]},{"url":"https://usn.ubuntu.com/4138-1/","label":"usn.ubuntu.com/4138-1/","hostname":"usn.ubuntu.com","tags":["Vendor Advisory","X Refsource UBUNTU","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.html","label":"lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/10/msg00005.html","label":"lists.debian.org/debian-lts-announce/2019/10/msg00005.html","hostname":"lists.debian.org","tags":["Mailing List","X Refsource MLIST","Third Party Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00055.html","label":"lists.opensuse.org/opensuse-security-announce/2019-10/msg00055.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE","Third Party Advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-9854","label":"ubuntu.com/security/CVE-2019-9854","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-4138-1","label":"ubuntu.com/security/notices/USN-4138-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9854","label":"www.cve.org/CVERecord?id=CVE-2019-9854","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-9854","label":"security-tracker.debian.org/tracker/CVE-2019-9854","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1769907","label":"bugzilla.redhat.com/show_bug.cgi?id=1769907","hostname":"bugzilla.redhat.com","tags":["Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":["DLA-1947-1","MGASA-2019-0340","OPENSUSE-SU-2019:2183-1","OPENSUSE-SU-2019:2361-1","OPENSUSE-SU-2024:10983-1","RHSA-2020:1151","RHSA-2020:1598","SUSE-SU-2019:2401-1","SUSE-SU-2019:2402-1","SUSE-SU-2019:2686-1"],"duplicates":[],"related":["OPENSUSE-SU-2019:2183-1","OPENSUSE-SU-2019:2361-1","OPENSUSE-SU-2024:10983-1","SUSE-SU-2019:2401-1","SUSE-SU-2019:2402-1","SUSE-SU-2019:2686-1"]},"timeline":[{"kind":"published","date":"2019-09-06T18:30:08.910Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-09-16T19:24:19.650Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":32,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T18:12:14.019Z","stale":false,"partial":false}}