cbcvebase.
CVE-2021-25633
published 2021-10-11

CVE-2021-25633: LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since…

PriorityP342high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.71%
49.7th percentile
LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to create a digitally signed ODF document, by manipulating the documentsignatures.xml or macrosignatures.xml stream within the document to combine multiple certificate data, which when opened caused LibreOffice to display a validly signed indicator but whose content was unrelated to the signature shown. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2.

Affected

14 ranges
VendorProductVersion rangeFixed in
apacheopenoffice< 4.1.114.1.11
apache_software_foundationapache_openofficeApache OpenOffice – 4.1.10
apache_software_foundationapache_openofficeOpenOffice.org – 3.4
debiandebian_linux
debianlibreoffice< libreoffice 1:7.2.0-2 (bookworm)libreoffice 1:7.2.0-2 (bookworm)
libreofficelibreoffice>= 0 < 1:7.0.4-4+deb11u11:7.0.4-4+deb11u1
libreofficelibreoffice>= 0 < 1:7.2.0-21:7.2.0-2
libreofficelibreoffice>= 0 < 1:7.2.0-21:7.2.0-2
libreofficelibreoffice>= 0 < 1:7.2.0-21:7.2.0-2
libreofficelibreoffice>= 7.0.0 < 7.0.67.0.6
libreofficelibreoffice>= 7.1.0 < 7.1.27.1.2
redhatresteasy>= 0 < 3.6.2-2ubuntu0.20.04.1~esm13.6.2-2ubuntu0.20.04.1~esm1
redhatresteasy>= 0 < 3.6.2-2ubuntu0.22.04.1~esm13.6.2-2ubuntu0.22.04.1~esm1
redhatresteasy>= 0 < 3.6.2-2ubuntu0.24.04.1~esm13.6.2-2ubuntu0.24.04.1~esm1

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.