CVE-2019-9849

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed where bullet graphics were omitted from this protection prior to version 6.2.5. This issue affects: Document Foundation LibreOffice versions prior to 6.2.5.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected software

VendorProductVersions
Document FoundationLibreOffice>= unspecified, < 6.2.5

References

Timeline

Published
Jul 17, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-98509.8LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands cCVE-2019-98519.8LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands cCVE-2019-98527.8LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over,CVE-2019-98537.8LibreOffice documents can contain macros. The execution of those macros is controlled by the document security settings, typically executionCVE-2019-98547.8LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over,CVE-2019-98559.8LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands cCVE-2019-98575.5In the Linux kernel through 5.0.2, the function inotify_update_existing_watch() in fs/notify/inotify/inotify_user.c neglects to call fsnotifCVE-2019-98588.8Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17. Horde/Form/Type.php contains a vulnerable class that handCVE-2019-98598.8Vesta Control Panel (VestaCP) 0.9.7 through 0.9.8-23 is vulnerable to an authenticated command execution that can result in remote root acceCVE-2019-98607.5Due to unencrypted signal communication and predictability of rolling codes, an attacker can "desynchronize" an ABUS Secvest wireless remoteCVE-2019-98618.1Due to the use of an insecure RFID technology (MIFARE Classic), ABUS proximity chip keys (RFID tokens) of the ABUS Secvest FUAA50000 wirelesCVE-2019-98626.5An issue was discovered on ABUS Secvest wireless alarm system FUAA50000 3.01.01 in conjunction with Secvest remote control FUBE50014 or FUBE
CVE-2019-9849: Medium severity, CVSS 4.3 | Vulnix