Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification
LibreOfficeKit can be used for accessing LibreOffice functionality through C/C++. Typically this is used by third party components to reuse LibreOffice as a library to convert, view or otherwise interact with documents.
LibreOffice internally makes use of "curl" to fetch remote resources such as images hosted on webservers.
In affected versions of LibreOffice, when used in LibreOfficeKit mode only, then curl's TLS certification verification was disabled (CURLOPT_SSL_VERIFYPEER of false)
In the fixed versions curl operates in LibreOfficeKit mode the same as in standard mode with CURLOPT_SSL_VERIFYPEER of true.
This issue affects LibreOffice before version 24.2.4.
CVSS Details
- CVSS 4.0 Base Score: 10 (CRITICAL)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libreoffice | Jul 27, 2026 | Jul 27, 2026 |
| Suse | — | Upgrade libreoffice-l10n-nbUpgrade libreoffice-l10n-pt_ptUpgrade libreoffice-l10n-mlUpgrade libreofficekitUpgrade libreoffice-l10n-svUpgrade libreoffice-mailmergeUpgrade libreoffice-l10n-astUpgrade libreoffice-drawUpgrade libreoffice-l10n-enUpgrade libreoffice-l10n-gdUpgrade libreoffice-l10n-kmr_latnUpgrade libreoffice-l10n-sw_tzUpgrade libreoffice-l10n-nnUpgrade libreoffice-l10n-cyUpgrade libreoffice-l10n-xhUpgrade libreoffice-l10n-zh_twUpgrade libreoffice-gladeUpgrade libreoffice-l10n-tgUpgrade libreoffice-l10n-ttUpgrade libreoffice-l10n-veUpgrade libreoffice-l10n-furUpgrade libreoffice-l10n-gugUpgrade libreoffice-l10n-ltUpgrade libreoffice-base-drivers-firebirdUpgrade libreoffice-l10n-maiUpgrade libreoffice-l10n-siUpgrade libreoffice-icon-themesUpgrade libreoffice-l10n-stUpgrade libreoffice-l10n-kokUpgrade libreoffice-l10n-dgoUpgrade libreoffice-l10n-brUpgrade libreoffice-l10n-mkUpgrade libreoffice-l10n-szlUpgrade libreoffice-gdb-pretty-printersUpgrade libreoffice-l10n-amUpgrade libreoffice-l10n-etUpgrade libreoffice-l10n-ukUpgrade libreoffice-l10n-fyUpgrade libreoffice-l10n-guUpgrade libreoffice-l10n-frUpgrade libreoffice-l10n-isUpgrade libreoffice-l10n-hyUpgrade libreoffice-librelogoUpgrade libreoffice-l10n-ocUpgrade libreoffice-l10n-zuUpgrade libreoffice-branding-upstreamUpgrade libreoffice-l10n-jaUpgrade libreoffice-l10n-kaUpgrade libreoffice-writerUpgrade libreoffice-l10n-myUpgrade libreoffice-l10n-rwUpgrade libreoffice-l10n-ca_valenciaUpgrade libreofficeUpgrade libreoffice-l10n-bsUpgrade libreoffice-l10n-viUpgrade libreoffice-l10n-caUpgrade libreoffice-l10n-sdUpgrade libreoffice-l10n-plUpgrade libreoffice-l10n-satUpgrade libreoffice-l10n-euUpgrade libreofficekit-develUpgrade libreoffice-l10n-fiUpgrade libreoffice-qt5Upgrade libreoffice-l10n-hrUpgrade libreoffice-l10n-ugUpgrade libreoffice-l10n-glUpgrade libreoffice-l10n-kabUpgrade libreoffice-l10n-mniUpgrade libreoffice-l10n-nsoUpgrade libreoffice-l10n-koUpgrade libreoffice-l10n-beUpgrade libreoffice-l10n-sa_inUpgrade libreoffice-l10n-thUpgrade libreoffice-l10n-roUpgrade libreoffice-l10n-heUpgrade libreoffice-l10n-dsbUpgrade libreoffice-l10n-daUpgrade libreoffice-l10n-ksUpgrade libreoffice-l10n-itUpgrade libreoffice-l10n-en_gbUpgrade libreoffice-l10n-faUpgrade libreoffice-l10n-asUpgrade libreoffice-impressUpgrade libreoffice-l10n-vecUpgrade libreoffice-l10n-brxUpgrade libreoffice-l10n-kmUpgrade libreoffice-mathUpgrade libreoffice-l10n-hiUpgrade libreoffice-l10n-esUpgrade libreoffice-l10n-sqUpgrade libreoffice-l10n-nlUpgrade libreoffice-l10n-mrUpgrade libreoffice-l10n-idUpgrade libreoffice-l10n-bgUpgrade libreoffice-gtk3Upgrade libreoffice-gnomeUpgrade libreoffice-base-drivers-postgresqlUpgrade libreoffice-sdk-docUpgrade libreoffice-sdkUpgrade libreoffice-l10n-zh_cnUpgrade libreoffice-l10n-tsUpgrade libreoffice-l10n-trUpgrade libreoffice-l10n-teUpgrade libreoffice-l10n-sidUpgrade libreoffice-l10n-uzUpgrade libreoffice-l10n-taUpgrade libreoffice-officebeanUpgrade libreoffice-l10n-dzUpgrade libreoffice-l10n-csUpgrade libreoffice-l10n-bn_inUpgrade libreoffice-l10n-afUpgrade libreoffice-baseUpgrade libreoffice-writer-extensionsUpgrade libreoffice-pyunoUpgrade libreoffice-l10n-paUpgrade libreoffice-l10n-nrUpgrade libreoffice-l10n-en_zaUpgrade libreoffice-l10n-elUpgrade libreoffice-l10n-skUpgrade libreoffice-filters-optionalUpgrade libreoffice-l10n-omUpgrade libreoffice-l10n-neUpgrade libreoffice-l10n-arUpgrade libreoffice-l10n-ruUpgrade libreoffice-l10n-slUpgrade libreoffice-l10n-loUpgrade libreoffice-l10n-orUpgrade libreoffice-l10n-gaUpgrade libreoffice-l10n-kkUpgrade libreoffice-l10n-knUpgrade libreoffice-l10n-deUpgrade libreoffice-calc-extensionsUpgrade libreoffice-l10n-ckbUpgrade libreoffice-l10n-srUpgrade libreoffice-calcUpgrade libreoffice-l10n-lbUpgrade libreoffice-l10n-eoUpgrade libreoffice-l10n-pt_brUpgrade libreoffice-l10n-boUpgrade libreoffice-l10n-bnUpgrade libreoffice-l10n-hsbUpgrade libreoffice-l10n-ssUpgrade libreoffice-l10n-huUpgrade libreoffice-l10n-lvUpgrade libreoffice-l10n-tnUpgrade libreoffice-l10n-mn | Oct 11, 2024 | Jun 25, 2024 |
| Ubuntu | — | Upgrade libreoffice | Jul 9, 2024 | Jun 25, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub