CVE-2020-12803: 
NixOS vulnerability analysis and mitigation

CVE-2020-12803 is a security vulnerability in LibreOffice that affects the handling of form submissions in ODF documents. The vulnerability was discovered by Jens Müller of Ruhr University Bochum and was publicly disclosed on June 09, 2020. The issue affects LibreOffice versions prior to 6.4.4, where the software allowed forms to be submitted to any URI, including file: URIs (LibreOffice Advisory).

The vulnerability exists in LibreOffice's implementation of the XForms W3C standard for ODF documents. Similar to HTML forms, ODF documents can contain forms that submit data to a URI. The flaw allowed forms to be submitted to any URI, including file: URIs, which could enable form submissions to overwrite local files. While user interaction is required to submit the form, malicious documents could be engineered to maximize the possibility of inadvertent user submission (LibreOffice Advisory, Ubuntu Notice).

If exploited, this vulnerability could allow an attacker to overwrite arbitrary files on the local system when a user is tricked into opening a specially crafted document and submitting a form. The impact is limited by the requirement for user interaction to submit the form (Red Hat Advisory, Ubuntu Notice).

The vulnerability requires user interaction to be exploited, as the user must actively submit the form within the document. However, documents could be crafted to increase the likelihood of inadvertent form submission by users (LibreOffice Advisory).

The vulnerability was fixed in LibreOffice version 6.4.4 by limiting form submissions to only http[s] URIs, removing the possibility to overwrite local files. Users are recommended to upgrade to LibreOffice version 6.4.4 or later. Various Linux distributions have also released security updates to address this vulnerability (LibreOffice Advisory, Debian LTS).