The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1151 advisory.

  - libreoffice: LibreLogo script can be manipulated into executing arbitrary python commands (CVE-2019-9848)

  - libreoffice: Remote resources protection module not applied to bullet graphics (CVE-2019-9849)

  - libreoffice: Insufficient URL validation allowing LibreLogo script execution (CVE-2019-9850)

  - libreoffice: LibreLogo global-event script execution (CVE-2019-9851)

  - libreoffice: Insufficient URL encoding flaw in allowed script location check (CVE-2019-9852)

  - libreoffice: Insufficient URL decoding flaw in categorizing macro location (CVE-2019-9853)

  - libreoffice: Unsafe URL assembly flaw in allowed script location check (CVE-2019-9854)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 7 : libreoffice (RHSA-2020:1151)

critical Nessus Plugin ID 135068

Version 1.10

Version 1.9

Version 1.8

Version 1.10 Mar 20, 2024, 2:35 PM CVSSv2 score source (changed from "CVE-2019-9852" to "CVE-2019-9851") Plugin Feed: 202403201435
Version 1.9 May 25, 2023, 5:09 PM Logic Changes (Added support for ppc64le architecture) Plugin Feed: 202305251709
Version 1.8 Jan 23, 2023, 7:12 PM Logic Changes (Added support for repository relative URLs) Plugin Feed: 202301231912