It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. An attacker could craft a document, which when opened by LibreOffice, would execute a Python method from a script in any arbitrary file system location, specified relative to the LibreOffice install location.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2019-2130 advisory.

  - It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal     attack which could be used to execute arbitrary macros bundled with a document. An attacker could craft a     document, which when opened by LibreOffice, would execute a Python method from a script in any arbitrary     file system location, specified relative to the LibreOffice install location. (CVE-2018-16858)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libreoffice packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - libreoffice: Arbitrary python functions in arbitrary     modules on the filesystem can be executed without     warning (CVE-2018-16858)

  - LibreOffice has a feature where documents can specify     that pre-installed scripts can be executed on various     document events such as mouse-over, etc. LibreOffice is     typically also bundled with LibreLogo, a programmable     turtle vector graphics script, which can be manipulated     into executing arbitrary python commands. By using the     document event feature to trigger LibreLogo to execute     python contained within a document a malicious document     could be constructed which would execute arbitrary     python commands silently without warning. In the fixed     versions, LibreLogo cannot be called from a document     event handler. This issue affects: Document Foundation     LibreOffice versions prior to 6.2.5.(CVE-2019-9848)

  - LibreOffice is typically bundled with LibreLogo, a     programmable turtle vector graphics script, which can     execute arbitrary python commands contained with the     document it is launched from. LibreOffice also has a     feature where documents can specify that pre-installed     scripts can be executed on various document script     events such as mouse-over, etc. Protection was added,     to address CVE-2019-9848, to block calling LibreLogo     from script event handers. However an insufficient url     validation vulnerability in LibreOffice allowed     malicious to bypass that protection and again trigger     calling LibreLogo from script event handlers. This     issue affects: Document Foundation LibreOffice versions     prior to 6.2.6.(CVE-2019-9850)

  - LibreOffice is typically bundled with LibreLogo, a     programmable turtle vector graphics script, which can     execute arbitrary python commands contained with the     document it is launched from. Protection was added, to     address CVE-2019-9848, to block calling LibreLogo from     document event script handers, e.g. mouse over. However     LibreOffice also has a separate feature where documents     can specify that pre-installed scripts can be executed     on various global script events such as document-open,     etc. In the fixed versions, global script event     handlers are validated equivalently to document script     event handlers. This issue affects: Document Foundation     LibreOffice versions prior to 6.2.6.(CVE-2019-9851)

  - LibreOffice has a feature where documents can specify     that pre-installed macros can be executed on various     script events such as mouse-over, document-open etc.
    Access is intended to be restricted to scripts under     the share/Scripts/python, user/Scripts/python     sub-directories of the LibreOffice install. Protection     was added, to address CVE-2018-16858, to avoid a     directory traversal attack where scripts in arbitrary     locations on the file system could be executed. However     this new protection could be bypassed by a URL encoding     attack. In the fixed versions, the parsed url     describing the script location is correctly encoded     before further processing. This issue affects: Document     Foundation LibreOffice versions prior to     6.2.6.(CVE-2019-9852)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for libreoffice is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link (s) in the References section.

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

Security Fix(es) :

* libreoffice: Arbitrary python functions in arbitrary modules on the filesystem can be executed without warning (CVE-2018-16858)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

Security Fix(es) :

  - libreoffice: Arbitrary python functions in arbitrary     modules on the filesystem can be executed without     warning (CVE-2018-16858)

This update for libreoffice and libraries fixes the following issues :

LibreOffice was updated to 6.2.5.2 (fate#327121 bsc#1128845 bsc#1123455), bringing lots of bug and stability fixes.

Additional bugfixes :

  - If there is no firebird engine we still need java to run     hsqldb (bsc#1135189)

  - PPTX: Rectangle turns from green to blue and loses     transparency when transparency is set (bsc#1135228)

  - Slide deck compression doesn't, hmm, compress too much     (bsc#1127760)

  - Psychedelic graphics in LibreOffice (but not PowerPoint)     (bsc#1124869)

  - Image from PPTX shown in a square, not a circle     (bsc#1121874)

libixion was updated to 0.14.1 :

  - Updated for new orcus

liborcus was updated to 0.14.1 :

  - Boost 1.67 support

  - Various cell handling issues fixed

libwps was updated to 0.4.10 :

  - QuattroPro: add parser of .qwp files

  - all: support complex encoding

mdds was updated to 1.4.3 :

  - Api change to 1.4

  - More multivector operations and tweaks

  - Various multi vector fixes

  - flat_segment_tree: add segment iterator and functions

  - fix to handle out-of-range insertions on     flat_segment_tree

  - Another api version -> rename to mdds-1_2

myspell-dictionaries was updated to 20190423 :

  - Serbian dictionary updated

  - Update af_ZA hunspell

  - Update Spanish dictionary

  - Update Slovenian dictionary

  - Update Breton dictionary

  - Update Galician dictionary

This update was imported from the SUSE:SLE-15:Update update project.

This update for libreoffice fixes the following issues :

LibreOffice was updated to 6.2.5.2 (fate#327121).

Security issue fixed :

CVE-2018-16858: LibreOffice was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document. An attacker could craft a document, which when opened by LibreOffice, would execute a Python method from a script in any arbitrary file system location, specified relative to the LibreOffice install location. (bsc#1124062)

Other bugfixes: If there is no firebird engine we still need java to run hsqldb (bsc#1135189)

Require firebird as default driver for base if enabled

PPTX: Rectangle turns from green to blue and loses transparency when transparency is set (bsc1135228)

Slide deck compression doesn't, hmm, compress too much (bsc#1127760)

Psychedelic graphics in LibreOffice (but not PowerPoint) (bsc#1124869)

Image from PPTX shown in a square, not a circle (bsc#1121874)

Switch to the new web based help system bsc#1116451

Enable new approach for mariadb connector again

PPTX: SmartArt: Basic rendering of the Organizational Chart (bsc#1112114)

PPTX: SmartArt: Basic rendering of Accent Process and Continuous Block Process (bsc#1112113)

Saving a new document can silently overwrite an existing document (bsc#1117300)

Install also C++ libreofficekit headers bsc#1117195

Chart in PPTX lacks color and is too large (bsc#882383)

PPTX: SmartArt: Basic rendering of several list types (bsc#1112112)

PPTX: Charts having weird/darker/ugly background versus Office 365 and strange artefacts where overlapping (bsc#1110348)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:2130 advisory.

  - libreoffice: Arbitrary python functions in arbitrary modules on the filesystem can be executed without     warning (CVE-2018-16858)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libreoffice and libraries fixes the following issues :

LibreOffice was updated to 6.2.5.2 (fate#327121 bsc#1128845 bsc#1123455), bringing lots of bug and stability fixes.

Additional bugfixes :

If there is no firebird engine we still need java to run hsqldb (bsc#1135189)

PPTX: Rectangle turns from green to blue and loses transparency when transparency is set (bsc#1135228)

Slide deck compression doesn't, hmm, compress too much (bsc#1127760)

Psychedelic graphics in LibreOffice (but not PowerPoint) (bsc#1124869)

Image from PPTX shown in a square, not a circle (bsc#1121874)

libixion was updated to 0.14.1: Updated for new orcus

liborcus was updated to 0.14.1: Boost 1.67 support

Various cell handling issues fixed

libwps was updated to 0.4.10: QuattroPro: add parser of .qwp files

all: support complex encoding

mdds was updated to 1.4.3: Api change to 1.4

More multivector operations and tweaks

Various multi vector fixes

flat_segment_tree: add segment iterator and functions

fix to handle out-of-range insertions on flat_segment_tree

Another api version -> rename to mdds-1_2

myspell-dictionaries was updated to 20190423: Serbian dictionary updated

Update af_ZA hunspell

Update Spanish dictionary

Update Slovenian dictionary

Update Breton dictionary

Update Galician dictionary

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libreoffice and libraries fixes the following issues :

LibreOffice was updated to 6.2.3.2 (fate#327121 bsc#1128845 bsc#1123455), bringing lots of bug and stability fixes.

Additional bugfixes :

If there is no firebird engine we still need java to run hsqldb (bsc#1135189)

PPTX: Rectangle turns from green to blue and loses transparency when transparency is set (bsc#1135228)

Slide deck compression doesn't, hmm, compress too much (bsc#1127760)

Psychedelic graphics in LibreOffice (but not PowerPoint) (bsc#1124869)

Image from PPTX shown in a square, not a circle (bsc#1121874)

libixion was updated to 0.14.1: Updated for new orcus

liborcus was updated to 0.14.1: Boost 1.67 support

Various cell handling issues fixed

libwps was updated to 0.4.10: QuattroPro: add parser of .qwp files

all: support complex encoding

mdds was updated to 1.4.3: Api change to 1.4

More multivector opreations and tweaks

Various multi vector fixes

flat_segment_tree: add segment iterator and functions

fix to handle out-of-range insertions on flat_segment_tree

Another api version -> rename to mdds-1_2

myspell-dictionaries was updated to 20190423: Serbian dictionary updated

Update af_ZA hunspell

Update Spanish dictionary

Update Slovenian dictionary

Update Breton dictionary

Update Galician dictionary

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Alex Infuehr discovered a directory traversal vulnerability which could result in the execution of Python script code when opening a malformed document.

For Debian 8 'Jessie', this problem has been fixed in version 1:4.3.3-2+deb8u12.

We recommend that you upgrade your libreoffice packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2018-16858 Directory traversal flaw in script execution

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that LibreOffice incorrectly handled certain document files. If a user were tricked into opening a specially crafted document, a remote attacker could cause LibreOffice to crash, and possibly execute arbitrary code. (CVE-2018-10119, CVE-2018-10120, CVE-2018-11790)

It was discovered that LibreOffice incorrectly handled embedded SMB connections in document files. If a user were tricked in to opening a specially crafted document, a remote attacker could possibly exploit this to obtain sensitive information. (CVE-2018-10583)

Alex Infuhr discovered that LibreOffice incorrectly handled embedded scripts in document files. If a user were tricked into opening a specially crafted document, a remote attacker could possibly execute arbitrary code. (CVE-2018-16858).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Alex Infuehr discovered a directory traversal vulnerability which could result in the execution of Python script code when opening a malformed document.

The version of LibreOffice installed on the remote Windows host is 6.1.x prior to 6.1.3.2. It is, therefore, affected by an an arbitrary code execution vulnerability as a result of a path traversal vulnerability allowing the ability to run any local python script, in addition to being able to pass user defined parameters to default python modules and functions included with libreoffice.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of LibreOffice installed on the remote macOS host is 6.1.x prior to 6.1.3.2. It is, therefore, affected by an an arbitrary code execution vulnerability as a result of a path traversal vulnerability allowing the ability to run any local python script, in addition to being able to pass user defined parameters to default python modules and functions included with libreoffice.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
180826	Oracle Linux 7 : libreoffice (ELSA-2019-2130)	Nessus	Oracle Linux Local Security Checks	critical
129441	EulerOS 2.0 SP8 : libreoffice (EulerOS-SA-2019-2082)	Nessus	Huawei Local Security Checks	critical
129133	EulerOS 2.0 SP5 : libreoffice (EulerOS-SA-2019-1976)	Nessus	Huawei Local Security Checks	critical
128358	CentOS 7 : libreoffice (CESA-2019:2130)	Nessus	CentOS Local Security Checks	critical
128233	Scientific Linux Security Update : libreoffice on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	critical
128014	openSUSE Security Update : LibreOffice (openSUSE-2019-1929)	Nessus	SuSE Local Security Checks	critical
127746	SUSE SLED15 / SLES15 Security Update : libreoffice (SUSE-SU-2019:2003-1)	Nessus	SuSE Local Security Checks	critical
127678	RHEL 7 : libreoffice (RHSA-2019:2130)	Nessus	Red Hat Local Security Checks	critical
126813	SUSE SLED15 / SLES15 Security Update : LibreOffice (SUSE-SU-2019:1894-1)	Nessus	SuSE Local Security Checks	critical
125798	SUSE SLED12 Security Update : LibreOffice (SUSE-SU-2019:1448-1)	Nessus	SuSE Local Security Checks	critical
122067	Debian DLA-1669-1 : libreoffice security update	Nessus	Debian Local Security Checks	critical
122041	Fedora 28 : 1:libreoffice (2019-cf9ddf9fff)	Nessus	Fedora Local Security Checks	critical
121640	Ubuntu 14.04 LTS / 16.04 LTS : LibreOffice vulnerabilities (USN-3883-1)	Nessus	Ubuntu Local Security Checks	critical
121559	Debian DSA-4381-1 : libreoffice - security update	Nessus	Debian Local Security Checks	critical
121544	LibreOffice 6.1.x < 6.1.3.2 Arbitrary Code Execution	Nessus	Windows	critical
121543	LibreOffice 6.1.x < 6.1.3.2 Arbitrary Code Execution (macOS)	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2018-16858

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical