CVE-2019-9849

LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed where bullet graphics were omitted from this protection prior to version 6.2.5. This issue affects: Document Foundation LibreOffice versions prior to 6.2.5.

• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00006.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.htmlMailing List, Third Party Advisory
• http://www.securityfocus.com/bid/109374Broken Link
• https://lists.debian.org/debian-lts-announce/2019/10/msg00005.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PMEGUWMWORC3DOVEHVXLFT3A5RSCMLBH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPTZJCNN52VNGSVC5DFKVW3EDMRDWKMP/
• https://security.gentoo.org/glsa/201908-13Third Party Advisory
• https://usn.ubuntu.com/4063-1/Third Party Advisory
• https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9849Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00006.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.htmlMailing List, Third Party Advisory
• http://www.securityfocus.com/bid/109374Broken Link
• https://lists.debian.org/debian-lts-announce/2019/10/msg00005.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PMEGUWMWORC3DOVEHVXLFT3A5RSCMLBH/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XPTZJCNN52VNGSVC5DFKVW3EDMRDWKMP/
• https://security.gentoo.org/glsa/201908-13Third Party Advisory
• https://usn.ubuntu.com/4063-1/Third Party Advisory
• https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9849Vendor Advisory

Published

Jul 17, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9843In DiffPlug Spotless before 1.20.0 (library and Maven plugin…
• CVE-2019-9844simple-markdown.js in Khan Academy simple-markdown before 0.…
• CVE-2019-9845madskristensen Miniblog.Core through 2019-01-16 allows remot…
• CVE-2019-9846RockOA 1.8.7 allows remote attackers to obtain sensitive inf…
• CVE-2019-9847A vulnerability in LibreOffice hyperlink processing allows a…
• CVE-2019-9848LibreOffice has a feature where documents can specify that p…9.8
• CVE-2019-9850LibreOffice is typically bundled with LibreLogo, a programma…9.8
• CVE-2019-9851LibreOffice is typically bundled with LibreLogo, a programma…9.8
• CVE-2019-9852LibreOffice has a feature where documents can specify that p…7.8
• CVE-2019-9853LibreOffice documents can contain macros. The execution of t…7.8
• CVE-2019-9854LibreOffice has a feature where documents can specify that p…7.8
• CVE-2019-9855LibreOffice is typically bundled with LibreLogo, a programma…9.8