Improper Certificate Validation in LibreOffice - CVE-2024-5261

Vulnerability identifier: #VU93313

CSH Severity: Medium

CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-5261

CWE-ID: CWE-295

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to missing certificate validation within the LibreOfficeKit when calling "curl" to fetch remote resources such as images hosted on web servers. A remote attacker can perform MitM attack.

LibreOffice
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Workstation Extension 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Workstation Extension 12
SUSE Package Hub 15
openSUSE Leap
Ubuntu
libreoffice (Ubuntu package)
libreoffice-l10n-hu
libreoffice-l10n-nn
libreoffice-l10n-pt_PT
libreoffice-l10n-zu
libreoffice-l10n-ja
libreoffice-l10n-hi
libreoffice-l10n-zh_CN
libreoffice-l10n-pl
libreoffice-l10n-hr
libreoffice-l10n-xh
libreoffice-l10n-ko
libreoffice-l10n-sv
libreoffice-l10n-ro
libreoffice-l10n-sk
libreoffice-l10n-bg
libreoffice-l10n-af
libreoffice-l10n-fr
libreoffice-icon-themes
libreoffice-l10n-pt_BR
libreoffice-l10n-en
libreoffice-l10n-nl
libreoffice-l10n-uk
libreoffice-l10n-es
libreoffice-l10n-zh_TW
libreoffice-l10n-it
libreoffice-l10n-da
libreoffice-l10n-ar
libreoffice-l10n-lt
libreoffice-l10n-ru
libreoffice-l10n-fi
libreoffice-l10n-nb
libreoffice-l10n-gu
libreoffice-l10n-de
libreoffice-branding-upstream
libreoffice-base
libreoffice-impress
libreoffice-l10n-cs
libreoffice-writer
libreoffice-calc-extensions
libreoffice-writer-extensions
libreoffice-calc-debuginfo
libreoffice-gtk3-debuginfo
libreoffice-base-drivers-postgresql-debuginfo
libreoffice-l10n-ca
libreoffice-writer-debuginfo
libreoffice-impress-debuginfo
libreoffice-officebean
libreoffice-filters-optional
libreoffice-debuginfo
libreoffice-sdk
libreoffice-sdk-debuginfo
libreoffice-debugsource
libreoffice-mailmerge
libreoffice-math
libreoffice-base-drivers-postgresql
libreoffice-gtk3
libreoffice-gnome
libreoffice-officebean-debuginfo
libreoffice-librelogo
libreoffice-pyuno-debuginfo
libreoffice-math-debuginfo
libreoffice-base-debuginfo
libreoffice-pyuno
libreoffice-gnome-debuginfo
libreoffice
libreoffice-draw-debuginfo
libreoffice-draw
libreoffice-calc
libreoffice-l10n-gl
libreoffice-glade
libreoffice-l10n-cy
libreoffice-l10n-ckb
libreoffice-l10n-ml
libreoffice-l10n-is
libreoffice-l10n-mk
libreoffice-l10n-hy
libreoffice-l10n-be
libreoffice-l10n-gd
libreoffice-l10n-br
libreoffice-l10n-hsb
libreoffice-l10n-en_ZA
libreoffice-l10n-fur
libreoffice-l10n-as
libreoffice-l10n-si
libreoffice-l10n-eo
libreoffice-l10n-sl
libreoffice-l10n-lb
libreoffice-l10n-sd
libreoffice-kdeintegration
libreoffice-l10n-ne
libreoffice-l10n-sat
libreoffice-l10n-ka
libreoffice-l10n-brx
libreoffice-l10n-fy
libreoffice-l10n-tt
libreoffice-l10n-mni
libreoffice-l10n-ast
libreoffice-l10n-en_GB
libreoffice-l10n-kn
libreoffice-l10n-uz
libreoffice-l10n-id
libreoffice-l10n-ta
libreoffice-l10n-my
libreoffice-l10n-lo
libreoffice-l10n-rw
libreoffice-l10n-dz
libreoffice-l10n-ts
libreoffice-l10n-sid
libreoffice-l10n-tn
libreoffice-l10n-mn
libreoffice-l10n-eu
libreoffice-l10n-nso
libreoffice-l10n-he
libreoffice-l10n-lv
libreoffice-l10n-mr
libreoffice-l10n-kab
libreoffice-l10n-bn_IN
libreoffice-l10n-nr
libreoffice-l10n-km
libreoffice-l10n-kmr_Latn
libreoffice-l10n-ga
libreoffice-l10n-fa
libreoffice-l10n-bo
libreoffice-l10n-sa_IN
libreoffice-l10n-oc
libreoffice-l10n-kok
libreoffice-l10n-vi
libreoffice-l10n-st
libreoffice-l10n-gug
libreoffice-l10n-ca_valencia
libreoffice-l10n-mai
libreoffice-gdb-pretty-printers
libreoffice-l10n-ks
libreoffice-base-drivers-firebird
libreoffice-qt5
libreoffice-base-drivers-firebird-debuginfo
libreoffice-sdk-doc
libreoffice-l10n-et
libreoffice-qt5-debuginfo
libreofficekit
libreofficekit-devel
libreoffice-l10n-ss
libreoffice-l10n-tr
libreoffice-l10n-dgo
libreoffice-l10n-el
libreoffice-l10n-ve
libreoffice-l10n-szl
libreoffice-l10n-kk
libreoffice-l10n-or
libreoffice-l10n-dsb
libreoffice-l10n-ug
libreoffice-l10n-sw_TZ
libreoffice-l10n-bn
libreoffice-l10n-tg
libreoffice-l10n-th
libreoffice-l10n-te
libreoffice-l10n-sq
libreoffice-l10n-vec
libreoffice-l10n-om
libreoffice-l10n-bs
libreoffice-l10n-am
libreoffice-l10n-pa
libreoffice-l10n-sr

Install updates from vendor's website.

LibreOffice - update to 24.2.4.1
libreoffice (Ubuntu package) - addressed in versions 4:7.6.7-0ubuntu0.23.10.3, 4:24.2.4-0ubuntu0.24.04.2
libreoffice-l10n-hu - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-nn - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-pt_PT - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-zu - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-ja - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-hi - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-zh_CN - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-pl - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-hr - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-xh - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-ko - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-sv - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-ro - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-sk - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-bg - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-af - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-fr - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-icon-themes - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-pt_BR - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-en - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-nl - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-uk - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-es - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-zh_TW - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-it - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-da - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-ar - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-lt - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-ru - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-fi - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-nb - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-gu - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-de - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-branding-upstream - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-base - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-impress - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-cs - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-writer - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-calc-extensions - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-writer-extensions - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-calc-debuginfo - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-gtk3-debuginfo - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-base-drivers-postgresql-debuginfo - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-ca - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-writer-debuginfo - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-impress-debuginfo - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-officebean - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-filters-optional - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-debuginfo - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-sdk - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-sdk-debuginfo - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-debugsource - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-mailmerge - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-math - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-base-drivers-postgresql - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-gtk3 - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-gnome - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-officebean-debuginfo - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-librelogo - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-pyuno-debuginfo - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-math-debuginfo - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-base-debuginfo - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-pyuno - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-gnome-debuginfo - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-draw-debuginfo - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-draw - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-calc - addressed in versions 24.8.1.2-48.64.2, 24.8.1.2-150500.20.11.2
libreoffice-l10n-gl - update to 24.8.1.2-150500.20.11.2
libreoffice-glade - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-cy - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-ckb - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-ml - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-is - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-mk - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-hy - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-be - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-gd - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-br - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-hsb - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-en_ZA - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-fur - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-as - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-si - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-eo - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-sl - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-lb - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-sd - update to 24.8.1.2-150500.20.11.2
libreoffice-kdeintegration - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-ne - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-sat - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-ka - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-brx - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-fy - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-tt - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-mni - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-ast - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-en_GB - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-kn - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-uz - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-id - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-ta - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-my - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-lo - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-rw - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-dz - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-ts - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-sid - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-tn - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-mn - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-eu - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-nso - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-he - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-lv - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-mr - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-kab - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-bn_IN - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-nr - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-km - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-kmr_Latn - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-ga - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-fa - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-bo - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-sa_IN - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-oc - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-kok - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-vi - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-st - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-gug - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-ca_valencia - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-mai - update to 24.8.1.2-150500.20.11.2
libreoffice-gdb-pretty-printers - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-ks - update to 24.8.1.2-150500.20.11.2
libreoffice-base-drivers-firebird - update to 24.8.1.2-150500.20.11.2
libreoffice-qt5 - update to 24.8.1.2-150500.20.11.2
libreoffice-base-drivers-firebird-debuginfo - update to 24.8.1.2-150500.20.11.2
libreoffice-sdk-doc - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-et - update to 24.8.1.2-150500.20.11.2
libreoffice-qt5-debuginfo - update to 24.8.1.2-150500.20.11.2
libreofficekit - update to 24.8.1.2-150500.20.11.2
libreofficekit-devel - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-ss - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-tr - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-dgo - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-el - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-ve - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-szl - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-kk - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-or - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-dsb - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-ug - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-sw_TZ - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-bn - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-tg - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-th - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-te - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-sq - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-vec - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-om - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-bs - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-am - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-pa - update to 24.8.1.2-150500.20.11.2
libreoffice-l10n-sr - update to 24.8.1.2-150500.20.11.2

• https://www.libreoffice.org/about-us/security/advisories/cve-2024-5261

• MitM attack in LibreOffice
• Ubuntu update for libreoffice
• SUSE update for libreoffice
• SUSE update for libreoffice