LibreOffice up to 6.2.6/6.3.2 Macro Office Document escape output

Summaryinfo

A vulnerability identified as critical has been detected in LibreOffice up to 6.2.6/6.3.2. This affects an unknown part of the component Macro Handler. Performing a manipulation as part of Office Document results in escape output. This vulnerability was named CVE-2019-9853. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in LibreOffice up to 6.2.6/6.3.2 (Office Suite Software). It has been classified as critical. This affects some unknown functionality of the component Macro Handler. The manipulation as part of a Office Document leads to a escape output vulnerability. CWE is classifying the issue as CWE-116. The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically execution of macros are blocked by default. A URL decoding flaw existed in how the urls to the macros within the document were processed and categorized, resulting in the possibility to construct a document where macro execution bypassed the security settings. The documents were correctly detected as containing macros, and prompted the user to their existence within the documents, but macros within the document were subsequently not controlled by the security settings allowing arbitrary macro execution This issue affects: LibreOffice 6.2 series versions prior to 6.2.7; LibreOffice 6.3 series versions prior to 6.3.1.

The weakness was presented 09/27/2019 (Website). It is possible to read the advisory at libreoffice.org. This vulnerability is uniquely identified as CVE-2019-9853 since 03/17/2019. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 276434 (TencentOS Server 3: libreoffice (TSSA-2022:0038)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.2.6 or 6.3.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (276434). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Office Suite Software

Name

• LibreOffice

Version

• 6.2.0
• 6.2.1
• 6.2.2
• 6.2.3
• 6.2.4
• 6.2.5
• 6.2.6
• 6.3.0
• 6.3.1
• 6.3.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion