ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF implements the XForms W3C standard, which allows data to be submitted without the need for macros or other active scripting Prior to version 6.4.4 LibreOffice allowed forms to be submitted to any URI, including file: URIs, enabling form submissions to overwrite local files. User-interaction is required to submit the form, but to avoid the possibility of malicious documents engineered to maximize the possibility of inadvertent user submission this feature has now been limited to http[s] URIs, removing the possibility to overwrite local files. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - libreoffice: heap-based buffer overflow related to the ReadJPEG function (CVE-2017-8358)

  - LibreOffice before 4.3.5 allows remote attackers to cause a denial of service (invalid write operation and     crash) and possibly execute arbitrary code via a crafted RTF file. (CVE-2014-9093)

  - LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to     retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to     disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote     graphic links loaded from docx documents were omitted from this protection prior to version 6.4.4. This     issue affects: The Document Foundation LibreOffice versions prior to 6.4.4. (CVE-2020-12802)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2020:4628 advisory.

  - LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to     retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to     disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote     graphic links loaded from docx documents were omitted from this protection prior to version 6.4.4. This     issue affects: The Document Foundation LibreOffice versions prior to 6.4.4. (CVE-2020-12802)

  - ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form     data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF     implements the XForms W3C standard, which allows data to be submitted without the need for macros or other     active scripting Prior to version 6.4.4 LibreOffice allowed forms to be submitted to any URI, including     file: URIs, enabling form submissions to overwrite local files. User-interaction is required to submit the     form, but to avoid the possibility of malicious documents engineered to maximize the possibility of     inadvertent user submission this feature has now been limited to http[s] URIs, removing the possibility to     overwrite local files. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.
    (CVE-2020-12803)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5694-1 advisory.

    It was discovered that LibreOffice incorrectly handled links using the Office URI Schemes. If a user were     tricked into opening a specially crafted document, a remote attacker could use this issue to execute     arbitrary scripts. (CVE-2022-3140)

    Thomas Florian discovered that LibreOffice incorrectly handled crashes when an encrypted document is open.
    If the document is recovered upon restarting LibreOffice, subsequent saves of the document were     unencrypted. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-12801)

    Jens Mller discovered that LibreOffice incorrectly handled certain documents containing forms. If a user     were tricked into opening a specially crafted document, a remote attacker could overwrite arbitrary files     when the form was submitted. This issue only affected Ubuntu 18.04 LTS. (CVE-2020-12803)

    It was discovered that LibreOffice incorrectly validated macro signatures. If a user were tricked into     opening a specially crafted document, a remote attacker could possibly use this issue to execute arbitrary     macros. This issue only affected Ubuntu 18.04 LTS. (CVE-2022-26305)

    It was discovered that Libreoffice incorrectly handled encrypting the master key provided by the user for     storing passwords for web connections. A local attacker could possibly use this issue to obtain access to     passwords stored in the users configuration data. This issue only affected Ubuntu 18.04 LTS.
    (CVE-2022-26306, CVE-2022-26307)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2020:4628 advisory.

  - LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to     retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to     disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote     graphic links loaded from docx documents were omitted from this protection prior to version 6.4.4. This     issue affects: The Document Foundation LibreOffice versions prior to 6.4.4. (CVE-2020-12802)

  - ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form     data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF     implements the XForms W3C standard, which allows data to be submitted without the need for macros or other     active scripting Prior to version 6.4.4 LibreOffice allowed forms to be submitted to any URI, including     file: URIs, enabling form submissions to overwrite local files. User-interaction is required to submit the     form, but to avoid the possibility of malicious documents engineered to maximize the possibility of     inadvertent user submission this feature has now been limited to http[s] URIs, removing the possibility to     overwrite local files. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.
    (CVE-2020-12803)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libreoffice packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - LibreOffice has a 'stealth mode' in which only     documents from locations deemed 'trusted' are allowed     to retrieve remote resources. This mode is not the     default mode, but can be enabled by users who want to     disable LibreOffice's ability to include remote     resources within a document. A flaw existed where     bullet graphics were omitted from this protection prior     to version 6.2.5. This issue affects: Document     Foundation LibreOffice versions prior to     6.2.5.(CVE-2019-9849)

  - ODF documents can contain forms to be filled out by the     user. Similar to HTML forms, the contained form data     can be submitted to a URI, for example, to an external     web server. To create submittable forms, ODF implements     the XForms W3C standard, which allows data to be     submitted without the need for macros or other active     scripting Prior to version 6.4.4 LibreOffice allowed     forms to be submitted to any URI, including file: URIs,     enabling form submissions to overwrite local files.
    User-interaction is required to submit the form, but to     avoid the possibility of malicious documents engineered     to maximize the possibility of inadvertent user     submission this feature has now been limited to http[s]     URIs, removing the possibility to overwrite local     files. This issue affects: The Document Foundation     LibreOffice versions prior to 6.4.4.(CVE-2020-12803)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CESA-2020:4628 advisory.

  - libreoffice: 'stealth mode' remote resource restrictions bypass (CVE-2020-12802)

  - libreoffice: forms allowed to be submitted to any URI could result in local file overwrite     (CVE-2020-12803)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-4628 advisory.

    libcmis     [0.5.2-1]
    - Related: rhbz#1796893 update to 0.5.2

    liborcus     [0.14.1-1]
    - Related: rhbz#1796893 update to 0.14.1

    libreoffice     [6.3.6.2-3.0.1]
    - Replace colors with Oracle colors [Orabug: 32120093]
    - Build with --with-vendor='Oracle America, Inc.'
    - Added the --with-hamcrest option to configure.

    [1:6.3.6.2-3]
    - Obsoletes any libreoffice-gtk2-debuginfo along with libreoffice-gtk2

    [1:6.3.6.2-2]
    - Resolves: rhbz#1841907 always produce utf-8 from gettext

    [1:6.3.6.2-1]
    - rhbz#1796893 latest stable release

    [1:6.3.5.2-7]
    - rhbz#1796893 dont show error dialog on G_IO_ERROR_FAILED_HANDLED

    [1:6.3.5.2-6]
    - rhbz#1819798 Start Center crash after pressing Help button before       using any topevel module

    [1:6.3.5.2-5]
    - rhbz#1796893 spreadsheetml2ooo.xsl was not well formed xml
    - rhbz#1796893 fix impress print dialog range

    [1:6.3.5.2-4]
    - rhbz#1796893 fix help->licence info->license

    [1:6.3.5.2-3]
    - rhbz#1796893 disable tip of the day by default

    [1:6.3.5.2-2]
    - rhbz#1796893 improve langpack requires

    [1:6.3.5.2-1]
    - rhbz#1796893 latest stable release

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4628 advisory.

    LibreOffice is an open source, community-developed office productivity suite. It includes key desktop     applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a     drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office     suite.

    The following packages have been upgraded to a later upstream version: libreoffice (6.3.6.2), libcmis     (0.5.2), liborcus (0.14.1). (BZ#1796893)

    Security Fix(es):

    * libreoffice: 'stealth mode' remote resource restrictions bypass (CVE-2020-12802)

    * libreoffice: forms allowed to be submitted to any URI could result in local file overwrite     (CVE-2020-12803)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libreoffice fixes the following issues :

  - Update to 6.4.5.2 :

  - Various fixes all around

  - Remove mime-info and application-registry dirs     bsc#1062631

  - Fix bsc#1172053 - LO-L3: Image disappears during     roundtrip 365->Impress->365

  - bsc1172053.diff

  - Fix bsc#1172189 - LO-L3: Impress crashes midway opening     a PPTX document

  - bsc1172189.diff

  - Fix bsc#1157627 - LO-L3: Some XML-created shapes simply     lost upon PPTX import (= earth loses countries)

  - bsc1157627.diff

  - Fix bsc#1146025 - LO-L3: Colored textboxes in PPTX look     very odd (SmartArt)

  - Fix bsc#1165849 - LO-L3: Shadow size for rectangle is     only a fraction of Office 365

  - bsc1165849-1.diff

  - bsc1165849-2.diff

  - bsc1165849-3.diff

This update was imported from the SUSE:SLE-15-SP1:Update update project.

- CVE-2020-12803 limit forms to http[s]

  - CVE-2020-12802 improve docx steathmode import

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

LibreOffice reports :

Two flaws were found in LibreOffice :

- CVE-2020-12802: remote graphics contained in docx format retrieved in 'stealth mode'

- CVE-2020-12803: XForms submissions could overwrite local files

ID	Name	Product	Family	Severity
199361	RHEL 7 : libreoffice (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196590	RHEL 6 : libreoffice (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
184770	Rocky Linux 8 : libreoffice (RLSA-2020:4628)	Nessus	Rocky Linux Local Security Checks	medium
166339	Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS : LibreOffice vulnerabilities (USN-5694-1)	Nessus	Ubuntu Local Security Checks	high
157612	AlmaLinux 8 : libreoffice (ALSA-2020:4628)	Nessus	Alma Linux Local Security Checks	medium
148079	EulerOS 2.0 SP5 : libreoffice (EulerOS-SA-2021-1687)	Nessus	Huawei Local Security Checks	medium
145973	CentOS 8 : libreoffice (CESA-2020:4628)	Nessus	CentOS Local Security Checks	medium
142813	Oracle Linux 8 : libreoffice (ELSA-2020-4628)	Nessus	Oracle Linux Local Security Checks	medium
142434	RHEL 8 : libreoffice (RHSA-2020:4628)	Nessus	Red Hat Local Security Checks	medium
139900	openSUSE Security Update : libreoffice (openSUSE-2020-1261)	Nessus	SuSE Local Security Checks	medium
139654	openSUSE Security Update : libreoffice (openSUSE-2020-1222)	Nessus	SuSE Local Security Checks	medium
137867	Fedora 31 : 1:libreoffice (2020-8922773bc4)	Nessus	Fedora Local Security Checks	medium
137438	FreeBSD : LibreOffice Security Advisory (96fb446d-ac7b-11ea-8b5e-b42e99a1b9c3)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2020-12803

medium

Tenable Plugins

critical

critical

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium