Security readout for executives and security teams
Plain-English summary
LibreOffice before 6.2.5 could still fetch remote bullet graphics even when a user enabled its optional trusted-location-only protection for remote resources. This weakens a privacy and content-control setting, mainly affecting users or systems that open untrusted documents and rely on that mode.
Executive priority
Treat as a targeted hygiene issue, not an emergency from the supplied evidence. Prioritize remediation where LibreOffice handles untrusted documents or where remote-resource blocking was relied on for privacy, tracking resistance, or containment.
Technical view
The flaw is a protection gap in LibreOffice stealth mode. Remote resource retrieval was restricted to trusted locations, but bullet graphics were omitted from that enforcement before version 6.2.5. The source bundle does not provide CVSS, CWE, exploit details, or broader affected-version granularity.
Likely exposure
Exposure is limited to LibreOffice installations before 6.2.5 where users enabled stealth mode or depended on remote-resource restrictions. Higher concern applies to mail gateways, VDI, shared workstations, or analyst systems that process untrusted office documents.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. The plausible abuse is forcing unexpected remote resource retrieval through document bullet graphics, but the bundle does not document exploit campaigns, payloads, or confirmed impact beyond the bypass.
Researcher notes
Key unknowns are CVSS severity, exact vulnerable version ranges beyond prior to 6.2.5, and whether bullet graphic retrieval creates impacts beyond remote resource access. Avoid claiming code execution or active exploitation from this bundle.
Mitigation direction
- Upgrade LibreOffice to version 6.2.5 or later.
- Apply distribution security updates from Ubuntu, Fedora, Gentoo, SUSE, or Debian as applicable.
- Review LibreOffice vendor guidance for supported fixed versions.
- Reduce opening of untrusted documents on outdated LibreOffice installations.
- Use network controls where document viewers should not fetch remote resources.
Validation and detection
- Inventory LibreOffice versions across endpoints and document-processing hosts.
- Confirm all installations are version 6.2.5 or later.
- Check whether stealth mode or remote-resource restrictions are used in policy.
- Review package manager history for relevant distribution security updates.
- Identify workflows that open external office documents on vulnerable versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-9849 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://www.libreoffice.org/about-us/security/advisories/CVE-2019-9849CVE reference · x_refsource_CONFIRM
- USN-4063-1CVE reference · vendor-advisory, x_refsource_UBUNTU
- FEDORA-2019-5561d20558CVE reference · vendor-advisory, x_refsource_FEDORA
- GLSA-201908-13CVE reference · vendor-advisory, x_refsource_GENTOO
- FEDORA-2019-2fe22a3a2cCVE reference · vendor-advisory, x_refsource_FEDORA
- [debian-lts-announce] 20191006 [SECURITY] [DLA 1947-1] libreoffice security updateCVE reference · mailing-list, x_refsource_MLIST
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.