10

CVE-2024-5261

Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification

LibreOfficeKit can be used for accessing LibreOffice functionality 
through C/C++. Typically this is used by third party components to reuse
 LibreOffice as a library to convert, view or otherwise interact with 
documents.

LibreOffice internally makes use of "curl" to fetch remote resources such as images hosted on webservers.

In
 affected versions of LibreOffice, when used in LibreOfficeKit mode 
only, then curl's TLS certification verification was disabled 
(CURLOPT_SSL_VERIFYPEER of false)

In the fixed versions curl operates in LibreOfficeKit mode the same as in standard mode with CURLOPT_SSL_VERIFYPEER of true.

This issue affects LibreOffice before version 24.2.4.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
This information is available to logged-in users.
Daten sind bereitgestellt durch das CVE Programm von Authorized Data Publishers (ADP) (Unstrukturiert)
Vendorlibreoffice
≫
Product libreoffice
Default Statusunknown
Version < 24.2.4
Version 0
Status affected
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.26% 0.488
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
security@documentfoundation.org 10 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.