LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote graphic links loaded from docx documents were omitted from this protection prior to version 6.4.4. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4628 advisory.

  - LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to     retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to     disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote     graphic links loaded from docx documents were omitted from this protection prior to version 6.4.4. This     issue affects: The Document Foundation LibreOffice versions prior to 6.4.4. (CVE-2020-12802)

  - ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form     data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF     implements the XForms W3C standard, which allows data to be submitted without the need for macros or other     active scripting Prior to version 6.4.4 LibreOffice allowed forms to be submitted to any URI, including     file: URIs, enabling form submissions to overwrite local files. User-interaction is required to submit the     form, but to avoid the possibility of malicious documents engineered to maximize the possibility of     inadvertent user submission this feature has now been limited to http[s] URIs, removing the possibility to     overwrite local files. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.
    (CVE-2020-12803)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4628 advisory.

  - LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to     retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to     disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote     graphic links loaded from docx documents were omitted from this protection prior to version 6.4.4. This     issue affects: The Document Foundation LibreOffice versions prior to 6.4.4. (CVE-2020-12802)

  - ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form     data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF     implements the XForms W3C standard, which allows data to be submitted without the need for macros or other     active scripting Prior to version 6.4.4 LibreOffice allowed forms to be submitted to any URI, including     file: URIs, enabling form submissions to overwrite local files. User-interaction is required to submit the     form, but to avoid the possibility of malicious documents engineered to maximize the possibility of     inadvertent user submission this feature has now been limited to http[s] URIs, removing the possibility to     overwrite local files. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.
    (CVE-2020-12803)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4628 advisory.

  - libreoffice: 'stealth mode' remote resource restrictions bypass (CVE-2020-12802)

  - libreoffice: forms allowed to be submitted to any URI could result in local file overwrite     (CVE-2020-12803)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4628 advisory.

  - LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to     retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to     disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote     graphic links loaded from docx documents were omitted from this protection prior to version 6.4.4. This     issue affects: The Document Foundation LibreOffice versions prior to 6.4.4. (CVE-2020-12802)

  - ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form     data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF     implements the XForms W3C standard, which allows data to be submitted without the need for macros or other     active scripting Prior to version 6.4.4 LibreOffice allowed forms to be submitted to any URI, including     file: URIs, enabling form submissions to overwrite local files. User-interaction is required to submit the     form, but to avoid the possibility of malicious documents engineered to maximize the possibility of     inadvertent user submission this feature has now been limited to http[s] URIs, removing the possibility to     overwrite local files. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.
    (CVE-2020-12803)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4628 advisory.

  - libreoffice: 'stealth mode' remote resource restrictions bypass (CVE-2020-12802)

  - libreoffice: forms allowed to be submitted to any URI could result in local file overwrite     (CVE-2020-12803)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libreoffice fixes the following issues :

  - Update to 6.4.5.2 :

  - Various fixes all around

  - Remove mime-info and application-registry dirs     bsc#1062631

  - Fix bsc#1172053 - LO-L3: Image disappears during     roundtrip 365->Impress->365

  - bsc1172053.diff

  - Fix bsc#1172189 - LO-L3: Impress crashes midway opening     a PPTX document

  - bsc1172189.diff

  - Fix bsc#1157627 - LO-L3: Some XML-created shapes simply     lost upon PPTX import (= earth loses countries)

  - bsc1157627.diff

  - Fix bsc#1146025 - LO-L3: Colored textboxes in PPTX look     very odd (SmartArt)

  - Fix bsc#1165849 - LO-L3: Shadow size for rectangle is     only a fraction of Office 365

  - bsc1165849-1.diff

  - bsc1165849-2.diff

  - bsc1165849-3.diff

This update was imported from the SUSE:SLE-15-SP1:Update update project.

- CVE-2020-12803 limit forms to http[s]

  - CVE-2020-12802 improve docx steathmode import

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

LibreOffice reports :

Two flaws were found in LibreOffice :

- CVE-2020-12802: remote graphics contained in docx format retrieved in 'stealth mode'

- CVE-2020-12803: XForms submissions could overwrite local files

ID	Name	Product	Family	Severity
184770	Rocky Linux 8 : libreoffice (RLSA-2020:4628)	Nessus	Rocky Linux Local Security Checks	medium
157612	AlmaLinux 8 : libreoffice (ALSA-2020:4628)	Nessus	Alma Linux Local Security Checks	medium
145973	CentOS 8 : libreoffice (CESA-2020:4628)	Nessus	CentOS Local Security Checks	medium
142813	Oracle Linux 8 : libreoffice (ELSA-2020-4628)	Nessus	Oracle Linux Local Security Checks	medium
142434	RHEL 8 : libreoffice (RHSA-2020:4628)	Nessus	Red Hat Local Security Checks	medium
139900	openSUSE Security Update : libreoffice (openSUSE-2020-1261)	Nessus	SuSE Local Security Checks	medium
139654	openSUSE Security Update : libreoffice (openSUSE-2020-1222)	Nessus	SuSE Local Security Checks	medium
137867	Fedora 31 : 1:libreoffice (2020-8922773bc4)	Nessus	Fedora Local Security Checks	medium
137438	FreeBSD : LibreOffice Security Advisory (96fb446d-ac7b-11ea-8b5e-b42e99a1b9c3)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2020-12802

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium