CVE-2019-9855

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on various document script events such as mouse-over, etc. Protection was added to block calling LibreLogo from script event handers. However a Windows 8.3 path equivalence handling flaw left LibreOffice vulnerable under Windows that a document could trigger executing LibreLogo via a Windows filename pseudonym. This issue affects: Document Foundation LibreOffice 6.2 versions prior to 6.2.7; 6.3 versions prior to 6.3.1.

• CWE-417

• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00055.htmlMailing List, Third Party Advisory
• https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9855/Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00067.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00055.htmlMailing List, Third Party Advisory
• https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9855/Vendor Advisory

Published

Sep 6, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9849LibreOffice has a 'stealth mode' in which only documents fro…4.3
• CVE-2019-9850LibreOffice is typically bundled with LibreLogo, a programma…9.8
• CVE-2019-9851LibreOffice is typically bundled with LibreLogo, a programma…9.8
• CVE-2019-9852LibreOffice has a feature where documents can specify that p…7.8
• CVE-2019-9853LibreOffice documents can contain macros. The execution of t…7.8
• CVE-2019-9854LibreOffice has a feature where documents can specify that p…7.8
• CVE-2019-9857In the Linux kernel through 5.0.2, the function inotify_upda…
• CVE-2019-9858Remote code execution was discovered in Horde Groupware Webm…8.8
• CVE-2019-9859Vesta Control Panel (VestaCP) 0.9.7 through 0.9.8-23 is vuln…8.8
• CVE-2019-9860Due to unencrypted signal communication and predictability o…
• CVE-2019-9861Due to the use of an insecure RFID technology (MIFARE Classi…
• CVE-2019-9862An issue was discovered on ABUS Secvest wireless alarm syste…