Detections
Analytics

Alpine: multiple libreoffice packages: security update to 6.4.4.2-r0

medium Tenable Self-Hosted Container Security Plugin ID 405259

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to
 retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to
 disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote
 graphic links loaded from docx documents were omitted from this protection prior to version 6.4.4. This
 issue affects: The Document Foundation LibreOffice versions prior to 6.4.4. (CVE-2020-12802)

 - ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form
 data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF
 implements the XForms W3C standard, which allows data to be submitted without the need for macros or other
 active scripting Prior to version 6.4.4 LibreOffice allowed forms to be submitted to any URI, including
 file: URIs, enabling form submissions to overwrite local files. User-interaction is required to submit the
 form, but to avoid the possibility of malicious documents engineered to maximize the possibility of
 inadvertent user submission this feature has now been limited to http[s] URIs, removing the possibility to
 overwrite local files. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.
 (CVE-2020-12803)

See Also

https://security.alpinelinux.org/vuln/CVE-2020-12802

https://security.alpinelinux.org/vuln/CVE-2020-12803

Plugin Details

Severity: Medium

ID: 405259

Version: Revision 1.36

Type: Local

Published: 10/31/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2020-12803

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 6/8/2020

Reference Information

CVE: CVE-2020-12802, CVE-2020-12803