CVE-2019-9849: Remote bullet graphics retrieved in “stealth mode” in LibreOffice

LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources.
This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document.
A flaw existed where bullet graphics were omitted from this protection prior to version 6.2.5.

HTML Tag	HTML Attribute	Triggers When Opened	Triggers On Save/Export
ol	src	No	Yes
ul	src	No	Yes

Vendor Disclosure:

The vendor's disclosure for this vulnerability can be found here.

Proof Of Concept:

More details and the exploitation process (plus other HTML tag-attribute combination that result in SSRF) can be found in this PDF.