Improper input validation in Apple Macos
CVE-2019-9847
A vulnerability in LibreOffice hyperlink processing allows an attacker to construct documents containing hyperlinks pointing to the location of an executable on the target users file system. If the hyperlink is activated by the victim the executable target is unconditionally launched. Under Windows and macOS when processing a hyperlink target explicitly activated by the user there was no judgment made on whether the target was an executable file, so such executable targets were launched unconditionally. This issue affects: All LibreOffice Windows and macOS versions prior to 6.1.6; LibreOffice Windows and macOS versions in the 6.2 series prior to 6.2.3.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.010 (59.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Apple Macos
- Document Foundation Libreoffice — versions unspecified, unspecified
- Libreoffice
- Microsoft Windows
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@documentfoundation.org (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-9847?
- CVE-2019-9847 is a high-severity vulnerability in Apple Macos, classified under Improper Input Validation. CVSS score: 7.8/10. Published 2019-05-09.
- How severe is CVE-2019-9847?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2019-9847 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.