LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote graphic links loaded from docx documents were omitted from this protection prior to version 6.4.4. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libreoffice: heap-based buffer overflow related to the ReadJPEG function (CVE-2017-8358)

  - LibreOffice before 4.3.5 allows remote attackers to cause a denial of service (invalid write operation and     crash) and possibly execute arbitrary code via a crafted RTF file. (CVE-2014-9093)

  - LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to     retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to     disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote     graphic links loaded from docx documents were omitted from this protection prior to version 6.4.4. This     issue affects: The Document Foundation LibreOffice versions prior to 6.4.4. (CVE-2020-12802)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4628 advisory.

  - LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to     retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to     disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote     graphic links loaded from docx documents were omitted from this protection prior to version 6.4.4. This     issue affects: The Document Foundation LibreOffice versions prior to 6.4.4. (CVE-2020-12802)

  - ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form     data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF     implements the XForms W3C standard, which allows data to be submitted without the need for macros or other     active scripting Prior to version 6.4.4 LibreOffice allowed forms to be submitted to any URI, including     file: URIs, enabling form submissions to overwrite local files. User-interaction is required to submit the     form, but to avoid the possibility of malicious documents engineered to maximize the possibility of     inadvertent user submission this feature has now been limited to http[s] URIs, removing the possibility to     overwrite local files. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.
    (CVE-2020-12803)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4628 advisory.

  - LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to     retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to     disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote     graphic links loaded from docx documents were omitted from this protection prior to version 6.4.4. This     issue affects: The Document Foundation LibreOffice versions prior to 6.4.4. (CVE-2020-12802)

  - ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form     data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF     implements the XForms W3C standard, which allows data to be submitted without the need for macros or other     active scripting Prior to version 6.4.4 LibreOffice allowed forms to be submitted to any URI, including     file: URIs, enabling form submissions to overwrite local files. User-interaction is required to submit the     form, but to avoid the possibility of malicious documents engineered to maximize the possibility of     inadvertent user submission this feature has now been limited to http[s] URIs, removing the possibility to     overwrite local files. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.
    (CVE-2020-12803)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4628 advisory.

  - libreoffice: 'stealth mode' remote resource restrictions bypass (CVE-2020-12802)

  - libreoffice: forms allowed to be submitted to any URI could result in local file overwrite     (CVE-2020-12803)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4628 advisory.

    libcmis     [0.5.2-1]
    - Related: rhbz#1796893 update to 0.5.2

    liborcus     [0.14.1-1]
    - Related: rhbz#1796893 update to 0.14.1

    libreoffice     [6.3.6.2-3.0.1]
    - Replace colors with Oracle colors [Orabug: 32120093]
    - Build with --with-vendor='Oracle America, Inc.'
    - Added the --with-hamcrest option to configure.

    [1:6.3.6.2-3]
    - Obsoletes any libreoffice-gtk2-debuginfo along with libreoffice-gtk2

    [1:6.3.6.2-2]
    - Resolves: rhbz#1841907 always produce utf-8 from gettext

    [1:6.3.6.2-1]
    - rhbz#1796893 latest stable release

    [1:6.3.5.2-7]
    - rhbz#1796893 dont show error dialog on G_IO_ERROR_FAILED_HANDLED

    [1:6.3.5.2-6]
    - rhbz#1819798 Start Center crash after pressing Help button before       using any topevel module

    [1:6.3.5.2-5]
    - rhbz#1796893 spreadsheetml2ooo.xsl was not well formed xml
    - rhbz#1796893 fix impress print dialog range

    [1:6.3.5.2-4]
    - rhbz#1796893 fix help->licence info->license

    [1:6.3.5.2-3]
    - rhbz#1796893 disable tip of the day by default

    [1:6.3.5.2-2]
    - rhbz#1796893 improve langpack requires

    [1:6.3.5.2-1]
    - rhbz#1796893 latest stable release

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4628 advisory.

    LibreOffice is an open source, community-developed office productivity suite. It includes key desktop     applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a     drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office     suite.

    The following packages have been upgraded to a later upstream version: libreoffice (6.3.6.2), libcmis     (0.5.2), liborcus (0.14.1). (BZ#1796893)

    Security Fix(es):

    * libreoffice: 'stealth mode' remote resource restrictions bypass (CVE-2020-12802)

    * libreoffice: forms allowed to be submitted to any URI could result in local file overwrite     (CVE-2020-12803)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libreoffice fixes the following issues :

  - Update to 6.4.5.2 :

  - Various fixes all around

  - Remove mime-info and application-registry dirs     bsc#1062631

  - Fix bsc#1172053 - LO-L3: Image disappears during     roundtrip 365->Impress->365

  - bsc1172053.diff

  - Fix bsc#1172189 - LO-L3: Impress crashes midway opening     a PPTX document

  - bsc1172189.diff

  - Fix bsc#1157627 - LO-L3: Some XML-created shapes simply     lost upon PPTX import (= earth loses countries)

  - bsc1157627.diff

  - Fix bsc#1146025 - LO-L3: Colored textboxes in PPTX look     very odd (SmartArt)

  - Fix bsc#1165849 - LO-L3: Shadow size for rectangle is     only a fraction of Office 365

  - bsc1165849-1.diff

  - bsc1165849-2.diff

  - bsc1165849-3.diff

This update was imported from the SUSE:SLE-15-SP1:Update update project.

- CVE-2020-12803 limit forms to http[s]

  - CVE-2020-12802 improve docx steathmode import

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

LibreOffice reports :

Two flaws were found in LibreOffice :

- CVE-2020-12802: remote graphics contained in docx format retrieved in 'stealth mode'

- CVE-2020-12803: XForms submissions could overwrite local files

ID	Name	Product	Family	Severity
199361	RHEL 7 : libreoffice (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196590	RHEL 6 : libreoffice (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
184770	Rocky Linux 8 : libreoffice (RLSA-2020:4628)	Nessus	Rocky Linux Local Security Checks	medium
157612	AlmaLinux 8 : libreoffice (ALSA-2020:4628)	Nessus	Alma Linux Local Security Checks	medium
145973	CentOS 8 : libreoffice (CESA-2020:4628)	Nessus	CentOS Local Security Checks	medium
142813	Oracle Linux 8 : libreoffice (ELSA-2020-4628)	Nessus	Oracle Linux Local Security Checks	medium
142434	RHEL 8 : libreoffice (RHSA-2020:4628)	Nessus	Red Hat Local Security Checks	medium
139900	openSUSE Security Update : libreoffice (openSUSE-2020-1261)	Nessus	SuSE Local Security Checks	medium
139654	openSUSE Security Update : libreoffice (openSUSE-2020-1222)	Nessus	SuSE Local Security Checks	medium
137867	Fedora 31 : 1:libreoffice (2020-8922773bc4)	Nessus	Fedora Local Security Checks	medium
137438	FreeBSD : LibreOffice Security Advisory (96fb446d-ac7b-11ea-8b5e-b42e99a1b9c3)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2020-12802

medium

Tenable Plugins

critical

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium