CVE-2019-9850: Canonical Ubuntu Linux

Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days.

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc. Protection was added, to address CVE-2019-9848, to block calling LibreLogo from script event handers. However an insufficient url validation vulnerability in LibreOffice allowed malicious to bypass that protection and again trigger calling LibreLogo from script event handlers. This issue affects: Document Foundation LibreOffice versions prior to 6.2.6.

Affected products

• Canonical Ubuntu Linux: version 16.04 only; version 18.04 only; version 19.04 only
• Debian Debian Linux: version 8.0 only; version 9.0 only; version 10.0 only
• Fedoraproject Fedora: version 29 only; version 30 only
• Libreoffice Libreoffice: before 6.2.6 (fixed in 6.2.6)
• Opensuse Leap: version 15.0 only; version 15.1 only

Published 2019-08-15. Last modified 2026-06-17.