PT-2020-3349 · Document Foundation+6 · Libreoffice+6
Published
2020-06-08
·
Updated
2024-06-15
·
CVE-2020-12802
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
LibreOffice versions prior to 6.4.4
Description
The issue is related to a flaw in LibreOffice's "stealth mode", which allows only documents from trusted locations to retrieve remote resources. This mode is not enabled by default but can be activated by users to prevent the inclusion of remote resources within a document. The flaw specifically concerns remote graphic links loaded from docx documents, which were not protected prior to version 6.4.4. This could potentially allow a remote attacker to access confidential data due to the lack of protection for internal data.
Recommendations
For versions prior to 6.4.4, update to version 6.4.4 or later to resolve the issue. As a temporary workaround, consider disabling the loading of remote graphic links from docx documents until the update is applied. Restrict access to sensitive documents and locations to minimize the risk of exploitation.
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Libreoffice
Red Hat
Rocky Linux
Suse