Skip to content
OpenAdvisories
Low ALSA-2020:4628 2 CVEs

Low: libreoffice security, bug fix, and enhancement update

Published Nov 3, 2020 · Updated Nov 5, 2026

Ecosystem: AlmaLinux

Summary

LibreOffice is an open source, community-developed office productivity suite. It includes key desktop applications, such as a word processor, a spreadsheet, a presentation manager, a formula editor, and a drawing program. LibreOffice replaces OpenOffice and provides a similar but enhanced and extended office suite.

The following packages have been upgraded to a later upstream version: libreoffice (6.3.6.2), libcmis (0.5.2), liborcus (0.14.1). (BZ#1796893)

Security Fix(es):

* libreoffice: 'stealth mode' remote resource restrictions bypass (CVE-2020-12802)

* libreoffice: forms allowed to be submitted to any URI could result in local file overwrite (CVE-2020-12803)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 3

ReleasePackageFixed in
AlmaLinux · 8 libcmis 0.5.2-1.el8
AlmaLinux · 8 libreoffice-sdk 1:6.3.6.2-3.el8.alma
AlmaLinux · 8 libreoffice-sdk-doc 1:6.3.6.2-3.el8.alma

Vulnerabilities 2

  • Unscored —
    CVE-2020-12802

    remote graphics contained in docx format retrieved in 'stealth mode'

    LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resou…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu Alpine
  • Unscored —
    CVE-2020-12803

    XForms submissions could overwrite local files

    ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF implements the XForms W3C standard, which allows d…

    The Document Foundation LibreOffice libreoffice libreoffice Debian Ubuntu Alpine

References

  • report
    https://bugzilla.redhat.com/1796893
  • report
    https://bugzilla.redhat.com/1819798
  • report
    https://bugzilla.redhat.com/1824876
  • report
    https://bugzilla.redhat.com/1841907
  • report
    https://bugzilla.redhat.com/1848346
  • report
    https://bugzilla.redhat.com/1850226
  • advisory
    https://errata.almalinux.org/8/ALSA-2020-4628.html
  • report
    https://vulners.com/cve/CVE-2020-12802
  • report
    https://vulners.com/cve/CVE-2020-12803