CVE-2024-5261

published 2024-06-25

CVE-2024-5261: Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification LibreOfficeKit can be used for…

Priority P3 54 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification

LibreOfficeKit can be used for accessing LibreOffice functionality
through C/C++. Typically this is used by third party components to reuse
LibreOffice as a library to convert, view or otherwise interact with
documents.

LibreOffice internally makes use of "curl" to fetch remote resources such as images hosted on webservers.

In
affected versions of LibreOffice, when used in LibreOfficeKit mode
only, then curl's TLS certification verification was disabled
(CURLOPT_SSL_VERIFYPEER of false)

In the fixed versions curl operates in LibreOfficeKit mode the same as in standard mode with CURLOPT_SSL_VERIFYPEER of true.

This issue affects LibreOffice before version 24.2.4.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
debian	libreoffice	< libreoffice 4:24.2.4-1 (forky)	libreoffice 4:24.2.4-1 (forky)
libreoffice	libreoffice	< 24.2.4	24.2.4
libreoffice	libreoffice	>= 0 < 4:24.2.4-1	4:24.2.4-1
libreoffice	libreoffice	>= 0 < 4:24.2.4-1	4:24.2.4-1
the_document_foundation	libreoffice	>= 24.2 < 24.2.4	24.2.4

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v4.0 10.0 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

osv 10.0 CRITICAL

vendor_debian 10.0 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-295