LibreOffice up to 6.4.3 Form ODF Document input validation

Summaryinfo

A vulnerability classified as critical has been found in LibreOffice up to 6.4.3. Affected by this issue is some unknown functionality of the component Form Handler. Performing a manipulation as part of ODF Document results in input validation. This vulnerability is reported as CVE-2020-12803. The attack requires a local approach. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in LibreOffice up to 6.4.3 (Office Suite Software). This affects some unknown processing of the component Form Handler. The manipulation as part of a ODF Document leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on integrity, and availability. The summary by CVE is:

ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF implements the XForms W3C standard, which allows data to be submitted without the need for macros or other active scripting Prior to version 6.4.4 LibreOffice allowed forms to be submitted to any URI, including file: URIs, enabling form submissions to overwrite local files. User-interaction is required to submit the form, but to avoid the possibility of malicious documents engineered to maximize the possibility of inadvertent user submission this feature has now been limited to http[s] URIs, removing the possibility to overwrite local files. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.

The weakness was disclosed 06/08/2020. This vulnerability is uniquely identified as CVE-2020-12803 since 05/12/2020. Attacking locally is a requirement. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 214472 (Debian dla-3703 : fonts-opensymbol - security update), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.4.4 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (214472). The entry VDB-156266 is pretty similar. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Office Suite Software

Name

• LibreOffice

Version

• 6.4.0
• 6.4.1
• 6.4.2
• 6.4.3

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion