Description
Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification
LibreOfficeKit can be used for accessing LibreOffice functionality
through C/C++. Typically this is used by third party components to reuse
LibreOffice as a library to convert, view or otherwise interact with
documents.
LibreOffice internally makes use of "curl" to fetch remote resources such as images hosted on webservers.
In
affected versions of LibreOffice, when used in LibreOfficeKit mode
only, then curl's TLS certification verification was disabled
(CURLOPT_SSL_VERIFYPEER of false)
In the fixed versions curl operates in LibreOfficeKit mode the same as in standard mode with CURLOPT_SSL_VERIFYPEER of true.
This issue affects LibreOffice before version 24.2.4.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Document Foundation | LibreOffice | 24.2 – < 24.2.4 | 24.2.4 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libreoffice | 4:24.2.4-1 | — |
| Debian 13 | libreoffice | 4:24.2.4-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | libreoffice | 4:24.2.4-0ubuntu0.24.04.2 | USN-6877-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | libreoffice | 24.8.1.2-150500.20.11.2 | SUSE-SU-2024:3577-1 |
| SLES 15 SP5 | libreoffice | 24.8.1.2-150500.20.11.2 | SUSE-SU-2024:3577-1 |
| SLES 12 SP5 | libreoffice | 24.8.1.2-48.64.2 | SUSE-SU-2024:3576-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | libreoffice | 24.2.5.2-1.1 | openSUSE-SU-2024:14186-1 |
| openSUSE Leap 15.6 | libreoffice | 24.8.1.2-150500.20.11.2 | SUSE-SU-2024:3577-1 |
| openSUSE Leap 15.5 | libreoffice | 24.8.1.2-150500.20.11.2 | SUSE-SU-2024:3577-1 |
Advisories 5
- USN-6877-1 libreoffice vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2024:14186-1 libreoffice-24.2.5.2-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3576-1 Security update for libreoffice SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3577-1 Security update for libreoffice SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1446 LibreOffice: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Oct 9, 2024