Vulnerability Description
LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote graphic links loaded from docx documents were omitted from this protection prior to version 6.4.4. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Libreoffice | Libreoffice | < 6.4.4 |
| Fedoraproject | Fedora | 31 |
| Opensuse | Leap | 15.1 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00042.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00058.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/12/msg00026.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://www.libreoffice.org/about-us/security/advisories/CVE-2020-12802Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00042.htmlMailing ListThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00058.htmlMailing ListThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/12/msg00026.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://www.libreoffice.org/about-us/security/advisories/CVE-2020-12802Vendor Advisory
FAQ
What is CVE-2020-12802?
CVE-2020-12802 is a vulnerability with a CVSS score of 5.3 (MEDIUM). LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who wa...
How severe is CVE-2020-12802?
CVE-2020-12802 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-12802?
Check the references section above for vendor advisories and patch information. Affected products include: Libreoffice Libreoffice, Fedoraproject Fedora, Opensuse Leap.