CVE-2019-9849 - CVE House
Back to Database
Status published Medium CVE-2019-9849

LibreOffice has a 'stealth mode' in which only documents from...

Vulnerability Description

LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed where bullet graphics were omitted from this protection prior to version 6.2.5. This issue affects: Document Foundation LibreOffice versions prior to 6.2.5.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-9849

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Thanks to Matei "Mal" Badanoiu for discovering and reporting this problem

References

More from Document Foundation

View All →
CVE-2019-9855
Windows 8.3 path equivalence handling flaw allows LibreLogo script execution
Critical 9.8
CVE-2019-9854
Unsafe URL assembly flaw in allowed script location check
High 7.8
CVE-2019-9853
Insufficient URL decoding flaw in categorizing macro location
High 7.8
CVE-2019-9852
Insufficient URL encoding flaw in allowed script location check
High 7.8
CVE-2019-9851
LibreLogo global-event script execution
Critical 9.8

Affected Vendor

Document Foundation

View all reports →

Affected Software

LibreOffice
Vulnerable Versions:
unspecified

Timeline

Official Publish: July 17th, 2019
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.