CVE-2021-25634
published 2021-10-12CVE-2021-25634: LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since…
PriorityP341high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.69%
48.8th percentile
LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to modify a digitally signed ODF document to insert an additional signing time timestamp which LibreOffice would incorrectly present as a valid signature signed at the bogus signing time. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | openoffice | < 4.1.11 | 4.1.11 |
| apache_software_foundation | apache_openoffice | Apache OpenOffice – 4.1.10 | — |
| apache_software_foundation | apache_openoffice | OpenOffice.org – 3.4 | — |
| debian | debian_linux | — | — |
| debian | libreoffice | < libreoffice 1:7.2.0-2 (bookworm) | libreoffice 1:7.2.0-2 (bookworm) |
| libreoffice | libreoffice | >= 0 < 1:7.0.4-4+deb11u1 | 1:7.0.4-4+deb11u1 |
| libreoffice | libreoffice | >= 0 < 1:7.2.0-2 | 1:7.2.0-2 |
| libreoffice | libreoffice | >= 0 < 1:7.2.0-2 | 1:7.2.0-2 |
| libreoffice | libreoffice | >= 0 < 1:7.2.0-2 | 1:7.2.0-2 |
| libreoffice | libreoffice | >= 7.0.0 < 7.0.6 | 7.0.6 |
| libreoffice | libreoffice | >= 7.1.0 < 7.1.2 | 7.1.2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-v4mw-2fgp-8j6c: LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurr
ghsa_unreviewed·2022-05-24
CVE-2021-25634 [HIGH] CWE-295 GHSA-v4mw-2fgp-8j6c: LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurr
LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to modify a digitally signed ODF document to insert an additional signing time timestamp which LibreOffice would incorrectly present as a valid signature signed at the bogus signing time. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2.
GHSA
GHSA-r2f7-jghr-r7x9: It is possible for an attacker to manipulate the timestamp of signed documents
ghsa_unreviewed·2022-05-24·CVSS 7.5
CVE-2021-41831 [HIGH] CWE-347 GHSA-r2f7-jghr-r7x9: It is possible for an attacker to manipulate the timestamp of signed documents
It is possible for an attacker to manipulate the timestamp of signed documents. All versions of Apache OpenOffice up to 4.1.10 are affected. Users are advised to update to version 4.1.11. See CVE-2021-25634 for the LibreOffice advisory.
OSV
CVE-2021-25634: LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurr
osv·2021-10-12·CVSS 7.5
CVE-2021-25634 [HIGH] CVE-2021-25634: LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurr
LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to modify a digitally signed ODF document to insert an additional signing time timestamp which LibreOffice would incorrectly present as a valid signature signed at the bogus signing time. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2.
Ubuntu
LibreOffice vulnerabilities
vendor_ubuntu·2021-11-22
CVE-2021-25634 LibreOffice vulnerabilities
Title: LibreOffice vulnerabilities
Summary: LibreOffice could incorrectly validate document signatures.
It was discovered that LibreOffice incorrectly handled digital signatures.
An attacker could possibly use this issue to create a specially crafted
document that would display a validly signed indicator, contrary to
expectations.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
libreoffice: Timestamp Manipulation with Signature Wrapping
vendor_redhat·2021-10-11·CVSS 7.5
CVE-2021-25634 [HIGH] CWE-295 libreoffice: Timestamp Manipulation with Signature Wrapping
libreoffice: Timestamp Manipulation with Signature Wrapping
LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to modify a digitally signed ODF document to insert an additional signing time timestamp which LibreOffice would incorrectly present as a valid signature signed at the bogus signing time. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2.
A flaw was found in LibreOffice, where it inserted a signing timestamp. This flaw allows LibreOffice to present a valid signature due to the al
Debian
CVE-2021-25634: libreoffice - LibreOffice supports digital signatures of ODF documents and macros within docum...
vendor_debian·2021·CVSS 7.5
CVE-2021-25634 [HIGH] CVE-2021-25634: libreoffice - LibreOffice supports digital signatures of ODF documents and macros within docum...
LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to modify a digitally signed ODF document to insert an additional signing time timestamp which LibreOffice would incorrectly present as a valid signature signed at the bogus signing time. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2.
Scope: local
bookworm: resolved (fixed in 1:7.2.0-2)
bullseye: resolved (fixed in 1:7.0.4-4+deb11u1)
forky: resolved (fixed in 1:7.2.0-2)
sid: resolved (fixed in 1:7.2.0-2)
trixie: resolved (fixed in 1:7.2
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-10-12
Published