Lucene search

K
osvGoogleOSV:ALSA-2020:4628
HistoryNov 03, 2020 - 12:21 p.m.

Low: libreoffice security, bug fix, and enhancement update

2020-11-0312:21:42
Google
osv.dev
10
libreoffice
security update
bug fix
enhancement
upgraded packages
remote resource restrictions bypass
cve-2020-12802
forms
local file overwrite
cve-2020-12803
almalinux
release notes

AI Score

6.7

Confidence

High

EPSS

0.003

Percentile

66.3%

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

The following packages have been upgraded to a later upstream version: libreoffice (6.3.6.2), libcmis (0.5.2), liborcus (0.14.1). (BZ#1796893)

Security Fix(es):

  • libreoffice: ‘stealth mode’ remote resource restrictions bypass (CVE-2020-12802)

  • libreoffice: forms allowed to be submitted to any URI could result in local file overwrite (CVE-2020-12803)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.