If LibreOffice has an encrypted document open and crashes, that document is auto-saved encrypted. On restart, LibreOffice offers to restore the document and prompts for the password to decrypt it. If the recovery is successful, and if the file format of the recovered document was not LibreOffice's default ODF file format, then affected versions of LibreOffice default that subsequent saves of the document are unencrypted. This may lead to a user accidentally saving a MSOffice file format document unencrypted while believing it to be encrypted. This issue affects: LibreOffice 6-3 series versions prior to 6.3.6; 6-4 series versions prior to 6.4.3.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3703 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-3703-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                   Bastien Roucaris     December 31, 2023                             https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : libreoffice     Version        : 1:6.1.5-3+deb10u11     CVE ID         : CVE-2020-12801 CVE-2020-12802 CVE-2020-12803 CVE-2023-6185                      CVE-2023-6186

    Multiple vulnerabilities have been discovered in LibreOffice an     office productivity software suite:

    CVE-2020-12801

        If LibreOffice has an encrypted document         open and crashes, that document is auto-saved encrypted.
        On restart, LibreOffice offers to restore the document         and prompts for the password to decrypt it. If the recovery         is successful, and if the file format of the recovered document         was not LibreOffice's default ODF file format, then affected versions         of LibreOffice default that subsequent saves of the document         are unencrypted. This may lead to a user accidentally saving         a MSOffice file format document unencrypted while believing         it to be encrypted.

    CVE-2020-12802

        LibreOffice has a 'stealth mode' in which only         documents from locations deemed 'trusted' are allowed to         retrieve remote resources. This mode is not the default mode,         but can be enabled by users who want to disable LibreOffice's ability         to include remote resources within a document. A flaw existed         where remote graphic links loaded from docx documents were omitted         from this protection.

    CVE-2020-12803

        ODF documents can contain forms to be         filled out by the user. Similar to HTML forms, the contained         form data can be submitted to a URI, for example, to an external         web server. To create submittable forms, ODF implements the         XForms W3C standard, which allows data to be submitted without         the need for macros or other active scripting. LibreOffice allowed         forms to be submitted to any URI, including file: URIs, enabling         form submissions to overwrite local files. User-interaction         is required to submit the form, but to avoid the possibility         of malicious documents engineered to maximize the possibility of         inadvertent user submission this feature has now been limited to         http[s] URIs, removing the possibility to overwrite local files.

    CVE-2023-6185

        An Improper Input Validation vulnerability         was found in GStreamer integration of The Document         Foundation LibreOffice allows an attacker to execute arbitrary         GStreamer plugins. In affected versions the filename of the         embedded video is not sufficiently escaped when passed to         GStreamer enabling an attacker to run arbitrary         gstreamer plugins depending on what plugins are installed         on the target system.

    CVE-2023-6186

        LibreOffice supports hyperlinks.
        In addition to the typical common protocols such as         http/https hyperlinks can also have target URLs that         can launch built-in macros or dispatch built-in         internal commands. In affected version of LibreOffice         there are scenarios where these can be executed without warning         if the user activates such hyperlinks. In later versions         the users's explicit macro execution permissions         for the document are now consulted if these non-typical         hyperlinks can be executed. The possibility to use these         variants of hyperlink targets for floating frames has been removed.

    For Debian 10 buster, these problems have been fixed in version     1:6.1.5-3+deb10u11.

    We recommend that you upgrade your libreoffice packages.

    For the detailed security status of libreoffice please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libreoffice

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5694-1 advisory.

    It was discovered that LibreOffice incorrectly handled links using the Office URI Schemes. If a user were     tricked into opening a specially crafted document, a remote attacker could use this issue to execute     arbitrary scripts. (CVE-2022-3140)

    Thomas Florian discovered that LibreOffice incorrectly handled crashes when an encrypted document is open.
    If the document is recovered upon restarting LibreOffice, subsequent saves of the document were     unencrypted. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-12801)

    Jens Mller discovered that LibreOffice incorrectly handled certain documents containing forms. If a user     were tricked into opening a specially crafted document, a remote attacker could overwrite arbitrary files     when the form was submitted. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-12803)

    It was discovered that LibreOffice incorrectly validated macro signatures. If a user were tricked into     opening a specially crafted document, a remote attacker could possibly use this issue to execute arbitrary     macros. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-26305)

    It was discovered that Libreoffice incorrectly handled encrypting the master key provided by the user for     storing passwords for web connections. A local attacker could possibly use this issue to obtain access to     passwords stored in the users configuration data. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2022-26306, CVE-2022-26307)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libreoffice to 6.4.4.2 fixes the following issues :

Security issue fixed :

  - CVE-2020-12801: Fixed an issue with encrypted MSOffice     documents that could be accidentally saved unencrypted     (bsc#1171997).

Non-security issues fixed :

  - Elements on title page mixed up (bsc#1160687).

  - Image shadow that should be invisible shown as     extraneous line below (bsc#1165870). 

This update was imported from the SUSE:SLE-15-SP1:Update update project.

ID	Name	Product	Family	Severity
214472	Debian dla-3703 : fonts-opensymbol - security update	Nessus	Debian Local Security Checks	high
166339	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : LibreOffice vulnerabilities (USN-5694-1)	Nessus	Ubuntu Local Security Checks	high
137251	openSUSE Security Update : libreoffice (openSUSE-2020-786)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2020-12801

medium

Tenable Plugins

high

high

medium