pepelyaevip/vuln-list-alt
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
97e1d0e3e2
vuln-list-alt/oval/c10f1/ALT-PU-2020-2512/definitions.json

237 lines
12 KiB
JSON
Raw Normal View History

ALT Vulnerability
2024-06-28 16:17:52 +03:00
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20202512",
"Version": "oval:org.altlinux.errata:def:20202512",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2020-2512: package `LibreOffice-still` update to version 6.4.5.2-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2020-2512",
"RefURL": "https://errata.altlinux.org/ALT-PU-2020-2512",
"Source": "ALTPU"
},
{
"RefID": "BDU:2020-02358",
"RefURL": "https://bdu.fstec.ru/vul/2020-02358",
"Source": "BDU"
},
{
"RefID": "BDU:2020-03672",
"RefURL": "https://bdu.fstec.ru/vul/2020-03672",
"Source": "BDU"
},
{
"RefID": "BDU:2020-03673",
"RefURL": "https://bdu.fstec.ru/vul/2020-03673",
"Source": "BDU"
},
{
"RefID": "CVE-2020-12801",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-12801",
"Source": "CVE"
},
{
"RefID": "CVE-2020-12802",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-12802",
"Source": "CVE"
},
{
"RefID": "CVE-2020-12803",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-12803",
"Source": "CVE"
}
],
"Description": "This update upgrades LibreOffice-still to version 6.4.5.2-alt1. \nSecurity Fix(es):\n\n * BDU:2020-02358: Уязвимость пакета офисных программ LibreOffice, связанная с ошибками при шифровании информации, позволяющая нарушителю получить доступ к защищаемой информации\n\n * BDU:2020-03672: Уязвимость компонента «скрытый режим» офисного пакета LibreOffice, позволяющая нарушителю получить доступ к конфиденциальным данным\n\n * BDU:2020-03673: Уязвимость офисного пакета LibreOffice, связанная с некоректной проверкой вводимых данных, позволяющая нарушителю оказать воздействие на целостность данных\n\n * CVE-2020-12801: If LibreOffice has an encrypted document open and crashes, that document is auto-saved encrypted. On restart, LibreOffice offers to restore the document and prompts for the password to decrypt it. If the recovery is successful, and if the file format of the recovered document was not LibreOffice's default ODF file format, then affected versions of LibreOffice default that subsequent saves of the document are unencrypted. This may lead to a user accidentally saving a MSOffice file format document unencrypted while believing it to be encrypted. This issue affects: LibreOffice 6-3 series versions prior to 6.3.6; 6-4 series versions prior to 6.4.3.\n\n * CVE-2020-12802: LibreOffice has a 'stealth mode' in which only documents from locations deemed 'trusted' are allowed to retrieve remote resources. This mode is not the default mode, but can be enabled by users who want to disable LibreOffice's ability to include remote resources within a document. A flaw existed where remote graphic links loaded from docx documents were omitted from this protection prior to version 6.4.4. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.\n\n * CVE-2020-12803: ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF implements the XForms W3C standard, which allows data to be submitted without the need for macros or other active scripting Prior to version 6.4.4 LibreOffice allowed forms to be submitted to any URI, including file: URIs, enabling form submissions to overwrite local files. User-interaction is required to submit the form, but to avoid the possibility of malicious documents engineered to maximize the possibility of inadvertent user submission this feature has now been limited to http[s] URIs, removing the possibility to overwrite local files. This issue affects: The Document Foundation LibreOffice versions prior to 6.4.4.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "High",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2020-08-08"
},
"Updated": {
"Date": "2020-08-08"
},
"BDUs": [
{
"ID": "BDU:2020-02358",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"CWE": "CWE-311",
"Href": "https://bdu.fstec.ru/vul/2020-02358",
"Impact": "Low",
"Public": "20200518"
},
{
"ID": "BDU:2020-03672",
"CVSS": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"CWE": "CWE-200",
"Href": "https://bdu.fstec.ru/vul/2020-03672",
"Impact": "Low",
"Public": "20200608"
},
{
"ID": "BDU:2020-03673",
"CVSS": "AV:N/AC:M/Au:N/C:N/I:C/A:N",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"CWE": "CWE-20",
"Href": "https://bdu.fstec.ru/vul/2020-03673",
"Impact": "High",
"Public": "20200608"
}
],
"CVEs": [
{
"ID": "CVE-2020-12801",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"CWE": "CWE-312",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-12801",
"Impact": "Low",
"Public": "20200518"
},
{
"ID": "CVE-2020-12802",
"CVSS": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"CWE": "NVD-CWE-Other",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-12802",
"Impact": "Low",
"Public": "20200608"
},
{
"ID": "CVE-2020-12803",
"CVSS": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"CWE": "CWE-20",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-12803",
"Impact": "Low",
"Public": "20200608"
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20202512001",
"Comment": "LibreOffice-still is earlier than 0:6.4.5.2-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202512002",
"Comment": "LibreOffice-still-common is earlier than 0:6.4.5.2-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202512003",
"Comment": "LibreOffice-still-extensions is earlier than 0:6.4.5.2-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202512004",
"Comment": "LibreOffice-still-gtk2 is earlier than 0:6.4.5.2-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202512005",
"Comment": "LibreOffice-still-gtk3 is earlier than 0:6.4.5.2-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202512006",
"Comment": "LibreOffice-still-integrated is earlier than 0:6.4.5.2-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202512007",
"Comment": "LibreOffice-still-kde5 is earlier than 0:6.4.5.2-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202512008",
"Comment": "LibreOffice-still-langpack-be is earlier than 0:6.4.5.2-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202512009",
"Comment": "LibreOffice-still-langpack-de is earlier than 0:6.4.5.2-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202512010",
"Comment": "LibreOffice-still-langpack-es is earlier than 0:6.4.5.2-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202512011",
"Comment": "LibreOffice-still-langpack-fr is earlier than 0:6.4.5.2-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202512012",
"Comment": "LibreOffice-still-langpack-kk is earlier than 0:6.4.5.2-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202512013",
"Comment": "LibreOffice-still-langpack-pt-BR is earlier than 0:6.4.5.2-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202512014",
"Comment": "LibreOffice-still-langpack-ru is earlier than 0:6.4.5.2-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202512015",
"Comment": "LibreOffice-still-langpack-tt is earlier than 0:6.4.5.2-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202512016",
"Comment": "LibreOffice-still-langpack-uk is earlier than 0:6.4.5.2-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202512017",
"Comment": "LibreOffice-still-mimetypes is earlier than 0:6.4.5.2-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202512018",
"Comment": "LibreOffice-still-qt5 is earlier than 0:6.4.5.2-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202512019",
"Comment": "LibreOffice-still-sdk is earlier than 0:6.4.5.2-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202512020",
"Comment": "libreofficekit-still is earlier than 0:6.4.5.2-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20202512021",
"Comment": "libreofficekit-still-devel is earlier than 0:6.4.5.2-alt1"
}
]
}
]
}
}
]
}
Reference in New Issue Copy Permalink