Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 519
Alerts This Week
Warning Icon 1 519

Ubuntu: 4138-1 Critical: LibreOffice Remote Code Execution

ubuntu
Calendar Grey September 24, 2019
Dist Ubuntu Esm H88
The Security Advisory USN-4139-1 for Ubuntu raises urgent alerts concerning severe vulnerabilities within LibreOffice, potentially enabling unauthorized code execution.
LibreOffice could be made to run programs as your login if it opened a specially crafted file.

Summary

LibreOffice could be made to run programs as your login if it opened a

specially crafted file.

Software Description:

- libreoffice: Office productivity suite

Details:

It was discovered that LibreOffice incorrectly handled embedded scripts in

document files. If a user were tricked into opening a specially crafted

document, a remote attacker could possibly execute arbitrary code.

Topics%20covered

Topics Covered

security advisory remote code execution arbitrary code execution ubuntu libreoffice

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 19.04:
  libreoffice-core                1:6.2.7-0ubuntu0.19.04.1

Ubuntu 18.04 LTS:
  libreoffice-core                1:6.0.7-0ubuntu0.18.04.10

Ubuntu 16.04 LTS:
  libreoffice-core                1:5.1.6~rc2-0ubuntu1~xenial10

After a standard system update you need to restart LibreOffice to make all
the necessary changes.

References

https://ubuntu.com/security/notices/USN-4138-1

CVE-2019-9854

Severity
critical
Lowest
Low
Medium
High
Critical

September 24, 2019

Topics%20covered

Topics Covered

security advisory remote code execution arbitrary code execution ubuntu libreoffice

Package Information

https://launchpad.net/ubuntu/+source/libreoffice/1:6.2.7-0ubuntu0.19.04.1
https://launchpad.net/ubuntu/+source/libreoffice/1:6.0.7-0ubuntu0.18.04.10
https://launchpad.net/ubuntu/+source/libreoffice/1:5.1.6~rc2-0ubuntu1~xenial10

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.