ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF implements the XForms W3C standard, which allows data to be submitted without the need for macros or other active scripting Prior to version 6.4.4 LibreOffice allowed forms to be submitted to any URI, including file: URIs, enabling form submissions to overwrite local files. User-interaction is required to submit the form, but to avoid the possibility of malicious documents engineered to maximize the possibility of inadvertent user submission this feature has now been limited to http[s] URIs, removing the possibility to overwrite local files. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4628 advisory.

  - LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to     retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to     disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote     graphic links loaded from docx documents were omitted from this protection prior to version 6.4.4. This     issue affects: The Document Foundation LibreOffice versions prior to 6.4.4. (CVE-2020-12802)

  - ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form     data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF     implements the XForms W3C standard, which allows data to be submitted without the need for macros or other     active scripting Prior to version 6.4.4 LibreOffice allowed forms to be submitted to any URI, including     file: URIs, enabling form submissions to overwrite local files. User-interaction is required to submit the     form, but to avoid the possibility of malicious documents engineered to maximize the possibility of     inadvertent user submission this feature has now been limited to http[s] URIs, removing the possibility to     overwrite local files. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.
    (CVE-2020-12803)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5694-1 advisory.

  - If LibreOffice has an encrypted document open and crashes, that document is auto-saved encrypted. On     restart, LibreOffice offers to restore the document and prompts for the password to decrypt it. If the     recovery is successful, and if the file format of the recovered document was not LibreOffice's default ODF     file format, then affected versions of LibreOffice default that subsequent saves of the document are     unencrypted. This may lead to a user accidentally saving a MSOffice file format document unencrypted while     believing it to be encrypted. This issue affects: LibreOffice 6-3 series versions prior to 6.3.6; 6-4     series versions prior to 6.4.3. (CVE-2020-12801)

  - ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form     data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF     implements the XForms W3C standard, which allows data to be submitted without the need for macros or other     active scripting Prior to version 6.4.4 LibreOffice allowed forms to be submitted to any URI, including     file: URIs, enabling form submissions to overwrite local files. User-interaction is required to submit the     form, but to avoid the possibility of malicious documents engineered to maximize the possibility of     inadvertent user submission this feature has now been limited to http[s] URIs, removing the possibility to     overwrite local files. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.
    (CVE-2020-12803)

  - LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint     server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected     versions of LibreOffice links using that scheme could be constructed to call internal macros with     arbitrary arguments. Which when clicked on, or activated by document events, could result in arbitrary     script execution without warning. This issue affects: The Document Foundation LibreOffice 7.4 versions     prior to 7.4.1; 7.3 versions prior to 7.3.6. (CVE-2022-3140)

  - An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was     signed by a trusted author was done by only matching the serial number and issuer string of the used     certificate with that of a trusted certificate. This is not sufficient to verify that the macro was     actually signed with the certificate. An adversary could therefore create an arbitrary certificate with a     serial number and an issuer string identical to a trusted certificate which LibreOffice would present as     belonging to the trusted author, potentially leading to the user to execute arbitrary code contained in     macros improperly trusted. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to     7.2.7; 7.3 versions prior to 7.3.1. (CVE-2022-26305)

  - LibreOffice supports the storage of passwords for web connections in the user's configuration database.
    The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice     existed where the required initialization vector for encryption was always the same which weakens the     security of the encryption making them vulnerable if an attacker has access to the user's configuration     data. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions     prior to 7.3.1. (CVE-2022-26306)

  - LibreOffice supports the storage of passwords for web connections in the user's configuration database.
    The stored passwords are encrypted with a single master key provided by the user. A flaw in LibreOffice     existed where master key was poorly encoded resulting in weakening its entropy from 128 to 43 bits making     the stored passwords vulerable to a brute force attack if an attacker has access to the users stored     config. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions     prior to 7.3.3. (CVE-2022-26307)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4628 advisory.

  - LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to     retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to     disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote     graphic links loaded from docx documents were omitted from this protection prior to version 6.4.4. This     issue affects: The Document Foundation LibreOffice versions prior to 6.4.4. (CVE-2020-12802)

  - ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form     data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF     implements the XForms W3C standard, which allows data to be submitted without the need for macros or other     active scripting Prior to version 6.4.4 LibreOffice allowed forms to be submitted to any URI, including     file: URIs, enabling form submissions to overwrite local files. User-interaction is required to submit the     form, but to avoid the possibility of malicious documents engineered to maximize the possibility of     inadvertent user submission this feature has now been limited to http[s] URIs, removing the possibility to     overwrite local files. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.
    (CVE-2020-12803)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libreoffice packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - LibreOffice has a 'stealth mode' in which only     documents from locations deemed 'trusted' are allowed     to retrieve remote resources. This mode is not the     default mode, but can be enabled by users who want to     disable LibreOffice's ability to include remote     resources within a document. A flaw existed where     bullet graphics were omitted from this protection prior     to version 6.2.5. This issue affects: Document     Foundation LibreOffice versions prior to     6.2.5.(CVE-2019-9849)

  - ODF documents can contain forms to be filled out by the     user. Similar to HTML forms, the contained form data     can be submitted to a URI, for example, to an external     web server. To create submittable forms, ODF implements     the XForms W3C standard, which allows data to be     submitted without the need for macros or other active     scripting Prior to version 6.4.4 LibreOffice allowed     forms to be submitted to any URI, including file: URIs,     enabling form submissions to overwrite local files.
    User-interaction is required to submit the form, but to     avoid the possibility of malicious documents engineered     to maximize the possibility of inadvertent user     submission this feature has now been limited to http[s]     URIs, removing the possibility to overwrite local     files. This issue affects: The Document Foundation     LibreOffice versions prior to 6.4.4.(CVE-2020-12803)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4628 advisory.

  - libreoffice: 'stealth mode' remote resource restrictions bypass (CVE-2020-12802)

  - libreoffice: forms allowed to be submitted to any URI could result in local file overwrite     (CVE-2020-12803)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4628 advisory.

  - LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to     retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to     disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote     graphic links loaded from docx documents were omitted from this protection prior to version 6.4.4. This     issue affects: The Document Foundation LibreOffice versions prior to 6.4.4. (CVE-2020-12802)

  - ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form     data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF     implements the XForms W3C standard, which allows data to be submitted without the need for macros or other     active scripting Prior to version 6.4.4 LibreOffice allowed forms to be submitted to any URI, including     file: URIs, enabling form submissions to overwrite local files. User-interaction is required to submit the     form, but to avoid the possibility of malicious documents engineered to maximize the possibility of     inadvertent user submission this feature has now been limited to http[s] URIs, removing the possibility to     overwrite local files. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.
    (CVE-2020-12803)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4628 advisory.

  - libreoffice: 'stealth mode' remote resource restrictions bypass (CVE-2020-12802)

  - libreoffice: forms allowed to be submitted to any URI could result in local file overwrite     (CVE-2020-12803)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libreoffice fixes the following issues :

  - Update to 6.4.5.2 :

  - Various fixes all around

  - Remove mime-info and application-registry dirs     bsc#1062631

  - Fix bsc#1172053 - LO-L3: Image disappears during     roundtrip 365->Impress->365

  - bsc1172053.diff

  - Fix bsc#1172189 - LO-L3: Impress crashes midway opening     a PPTX document

  - bsc1172189.diff

  - Fix bsc#1157627 - LO-L3: Some XML-created shapes simply     lost upon PPTX import (= earth loses countries)

  - bsc1157627.diff

  - Fix bsc#1146025 - LO-L3: Colored textboxes in PPTX look     very odd (SmartArt)

  - Fix bsc#1165849 - LO-L3: Shadow size for rectangle is     only a fraction of Office 365

  - bsc1165849-1.diff

  - bsc1165849-2.diff

  - bsc1165849-3.diff

This update was imported from the SUSE:SLE-15-SP1:Update update project.

- CVE-2020-12803 limit forms to http[s]

  - CVE-2020-12802 improve docx steathmode import

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

LibreOffice reports :

Two flaws were found in LibreOffice :

- CVE-2020-12802: remote graphics contained in docx format retrieved in 'stealth mode'

- CVE-2020-12803: XForms submissions could overwrite local files

ID	Name	Product	Family	Severity
184770	Rocky Linux 8 : libreoffice (RLSA-2020:4628)	Nessus	Rocky Linux Local Security Checks	medium
166339	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : LibreOffice vulnerabilities (USN-5694-1)	Nessus	Ubuntu Local Security Checks	high
157612	AlmaLinux 8 : libreoffice (ALSA-2020:4628)	Nessus	Alma Linux Local Security Checks	medium
148079	EulerOS 2.0 SP5 : libreoffice (EulerOS-SA-2021-1687)	Nessus	Huawei Local Security Checks	medium
145973	CentOS 8 : libreoffice (CESA-2020:4628)	Nessus	CentOS Local Security Checks	medium
142813	Oracle Linux 8 : libreoffice (ELSA-2020-4628)	Nessus	Oracle Linux Local Security Checks	medium
142434	RHEL 8 : libreoffice (RHSA-2020:4628)	Nessus	Red Hat Local Security Checks	medium
139900	openSUSE Security Update : libreoffice (openSUSE-2020-1261)	Nessus	SuSE Local Security Checks	medium
139654	openSUSE Security Update : libreoffice (openSUSE-2020-1222)	Nessus	SuSE Local Security Checks	medium
137867	Fedora 31 : 1:libreoffice (2020-8922773bc4)	Nessus	Fedora Local Security Checks	medium
137438	FreeBSD : LibreOffice Security Advisory (96fb446d-ac7b-11ea-8b5e-b42e99a1b9c3)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2020-12803

medium

Tenable Plugins

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium