CVE-2019-9855 : What You Need to Know

LibreOffice is vulnerable to a flaw related to Windows 8.3 path equivalence handling, allowing the execution of LibreLogo scripts through a Windows filename pseudonym.

Understanding CVE-2019-9855

This CVE highlights a security vulnerability in LibreOffice that could be exploited on Windows systems.

What is CVE-2019-9855?

LibreOffice, bundled with LibreLogo, a turtle vector graphics script, can execute Python commands within the document it is launched from. A flaw in Windows 8.3 path equivalence handling allows the execution of LibreLogo through a Windows filename pseudonym.

The Impact of CVE-2019-9855

This vulnerability affects versions of Document Foundation LibreOffice prior to 6.2.7 for LibreOffice 6.2 and versions prior to 6.3.1 for LibreOffice 6.3.

Technical Details of CVE-2019-9855

This section provides more in-depth technical information about the CVE.

Vulnerability Description

The flaw in Windows 8.3 path equivalence handling enables the execution of LibreLogo scripts through a Windows filename pseudonym, posing a security risk.

Affected Systems and Versions

Product: LibreOffice
Vendor: Document Foundation
Versions Affected:
LibreOffice 6.2 versions prior to 6.2.7
LibreOffice 6.3 versions prior to 6.3.1

Exploitation Mechanism

The vulnerability allows a document to trigger the execution of LibreLogo through a Windows filename pseudonym, potentially leading to unauthorized script execution.

Mitigation and Prevention

Protecting systems from CVE-2019-9855 is crucial to maintaining security.

Immediate Steps to Take

Update LibreOffice to version 6.2.7 or higher for LibreOffice 6.2, and version 6.3.1 or higher for LibreOffice 6.3.
Avoid opening documents from untrusted sources.

Long-Term Security Practices

Regularly update software to patch known vulnerabilities.
Educate users on safe document handling practices to prevent script execution.

Patching and Updates

Document Foundation has released patches to address this vulnerability. Ensure timely installation of these updates to secure systems.