Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification
LibreOfficeKit can be used for accessing LibreOffice functionality through C/C++. Typically this is used by third party components to reuse LibreOffice as a library to convert, view or otherwise interact with documents.
LibreOffice internally makes use of "curl" to fetch remote resources such as images hosted on webservers.
In affected versions of LibreOffice, when used in LibreOfficeKit mode only, then curl's TLS certification verification was disabled (CURLOPT_SSL_VERIFYPEER of false)
In the fixed versions curl operates in LibreOfficeKit mode the same as in standard mode with CURLOPT_SSL_VERIFYPEER of true.
This issue affects LibreOffice before version 24.2.4.
CVSS Details
- CVSS 4.0 Base Score: 10 (CRITICAL)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libreoffice | Jul 27, 2026 | Jul 27, 2026 |
| Suse | — | Upgrade libreoffice-filters-optionalUpgrade libreoffice-l10n-elUpgrade libreoffice-l10n-zh_CNUpgrade libreoffice-l10n-sa_inUpgrade libreoffice-baseUpgrade libreoffice-l10n-en_zaUpgrade libreoffice-l10n-nrUpgrade libreoffice-l10n-vecUpgrade libreoffice-l10n-taUpgrade libreoffice-officebeanUpgrade libreoffice-l10n-dzUpgrade libreoffice-pyunoUpgrade libreoffice-writer-extensionsUpgrade libreoffice-l10n-thUpgrade libreoffice-l10n-asUpgrade libreoffice-l10n-skUpgrade libreoffice-l10n-uzUpgrade libreoffice-l10n-paUpgrade libreoffice-l10n-sidUpgrade libreoffice-l10n-afUpgrade libreoffice-l10n-bn_inUpgrade libreoffice-l10n-csUpgrade libreoffice-l10n-brxUpgrade libreoffice-l10n-nlUpgrade libreoffice-l10n-bgUpgrade libreoffice-l10n-hiUpgrade libreoffice-l10n-sqUpgrade libreoffice-l10n-ksUpgrade libreoffice-l10n-ssUpgrade libreoffice-l10n-huUpgrade libreoffice-l10n-mrUpgrade libreoffice-l10n-hsbUpgrade libreoffice-l10n-idUpgrade libreoffice-l10n-trUpgrade libreoffice-l10n-eoUpgrade libreoffice-l10n-dsbUpgrade libreoffice-l10n-lbUpgrade libreoffice-l10n-bnUpgrade libreoffice-l10n-kmUpgrade libreoffice-l10n-koUpgrade libreoffice-l10n-heUpgrade libreoffice-l10n-boUpgrade libreoffice-l10n-faUpgrade libreoffice-l10n-daUpgrade libreoffice-l10n-esUpgrade libreoffice-l10n-nsoUpgrade libreoffice-l10n-slUpgrade libreoffice-l10n-srUpgrade libreoffice-l10n-roUpgrade libreoffice-l10n-ckbUpgrade libreoffice-l10n-deUpgrade libreoffice-calcUpgrade libreoffice-l10n-orUpgrade libreoffice-l10n-gaUpgrade libreoffice-l10n-loUpgrade libreoffice-calc-extensionsUpgrade libreoffice-l10n-kkUpgrade libreoffice-base-drivers-postgresqlUpgrade libreoffice-gnomeUpgrade libreoffice-sdk-docUpgrade libreoffice-gtk3Upgrade libreoffice-l10n-tsUpgrade libreoffice-sdkUpgrade libreoffice-impressUpgrade libreoffice-l10n-ruUpgrade libreoffice-l10n-teUpgrade libreoffice-l10n-knUpgrade libreoffice-l10n-arUpgrade libreoffice-l10n-beUpgrade libreoffice-l10n-omUpgrade libreoffice-l10n-tnUpgrade libreoffice-l10n-neUpgrade libreoffice-l10n-zh_TWUpgrade libreoffice-l10n-en_gbUpgrade libreoffice-l10n-itUpgrade libreoffice-l10n-mnUpgrade libreoffice-mathUpgrade libreoffice-l10n-lvUpgrade libreoffice-librelogoUpgrade libreoffice-l10n-fyUpgrade libreoffice-l10n-amUpgrade libreoffice-drawUpgrade libreoffice-l10n-astUpgrade libreoffice-l10n-sdUpgrade libreoffice-l10n-pt_BRUpgrade libreoffice-l10n-isUpgrade libreoffice-l10n-frUpgrade libreoffice-l10n-etUpgrade libreoffice-l10n-guUpgrade libreoffice-gdb-pretty-printersUpgrade libreoffice-l10n-mniUpgrade libreoffice-l10n-glUpgrade libreoffice-l10n-gugUpgrade libreoffice-l10n-maiUpgrade libreoffice-l10n-ltUpgrade libreoffice-base-drivers-firebirdUpgrade libreoffice-l10n-veUpgrade libreoffice-l10n-ttUpgrade libreoffice-l10n-stUpgrade libreoffice-l10n-tgUpgrade libreoffice-l10n-kokUpgrade libreoffice-l10n-pt_PTUpgrade libreoffice-l10n-furUpgrade libreoffice-l10n-svUpgrade libreoffice-l10n-rwUpgrade libreoffice-l10n-kaUpgrade libreoffice-l10n-hyUpgrade libreoffice-mailmergeUpgrade libreoffice-writerUpgrade libreoffice-l10n-zuUpgrade libreoffice-l10n-jaUpgrade libreoffice-branding-upstreamUpgrade libreoffice-gladeUpgrade libreoffice-l10n-ocUpgrade libreoffice-l10n-brUpgrade libreoffice-l10n-ukUpgrade libreoffice-l10n-nnUpgrade libreoffice-l10n-kmr_latnUpgrade libreoffice-l10n-hrUpgrade libreoffice-l10n-gdUpgrade libreoffice-l10n-enUpgrade libreoffice-l10n-sw_tzUpgrade libreoffice-l10n-siUpgrade libreofficekitUpgrade libreoffice-icon-themesUpgrade libreoffice-l10n-cyUpgrade libreoffice-l10n-mkUpgrade libreoffice-l10n-szlUpgrade libreoffice-l10n-dgoUpgrade libreoffice-l10n-euUpgrade libreoffice-l10n-ca_valenciaUpgrade libreoffice-l10n-caUpgrade libreoffice-l10n-kabUpgrade libreofficeUpgrade libreoffice-l10n-viUpgrade libreoffice-l10n-ugUpgrade libreoffice-l10n-satUpgrade libreoffice-l10n-plUpgrade libreoffice-l10n-myUpgrade libreoffice-l10n-bsUpgrade libreoffice-l10n-fiUpgrade libreofficekit-develUpgrade libreoffice-l10n-nbUpgrade libreoffice-l10n-mlUpgrade libreoffice-l10n-xhUpgrade libreoffice-qt5 | Oct 11, 2024 | Jun 25, 2024 |
| Ubuntu | — | Upgrade libreoffice | Jul 9, 2024 | Jun 25, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub