Summary
It was discovered that LibreOffice would incorrectly handle digital
signature verification after repairing a corrupted document. A remote
attacker could possibly use this issue to forge valid signatures.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | libreoffice | 1:6.4.7-0ubuntu0.20.04.12 |
| Ubuntu · 22.04 LTS 22.04:LTS | libreoffice | 1:7.3.7-0ubuntu0.22.04.7 |
Vulnerabilities 1
-
High 7.8
Signatures in "repair mode" should not be trusted
Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerability in LibreOfficeThis issue affects LibreOffice: from 24.2 before < 24.2.5.
References
-
report
https://ubuntu.com/security/CVE-2024-7788