Vulnerability

CERT-In Vulnerability Note CIVN-2021-0266
Multiple Vulnerabilities in LibreOffice

Original Issue Date:October 18, 2021

Severity Rating: HIGH

Software Affected

LibreOffice versions prior to LibreOffice 7.0.6/7.1.2

Overview

Multiple vulnerabilities have been reported in LibreOffice which could be exploited by a remote attacker to compromise a targeted system.

Description

These vulnerabilities exist in LibreOffice due to improper certification and verification of validation for digital signature of ODF files and cryptographic signature. An attacker can exploit these vulnerabilities by manipulating the documentsignatures.xml or microsignatures.xml stream within the document to combine multiple certificate data, and create a digitally signed ODF document and by displaying a validly signed indicator but whose content was unrelated to the signature shown and also manipulate the timestamp of signed documents.

Successful exploitation of these vulnerabilities could allow the remote attacker to conduct spoofing attack on targeted system.

Solution

Upgrade to LibreOffice 7.0.6/7.1.2
https://www.libreoffice.org/about-us/security/advisories/cve-2021-25632/

https://www.libreoffice.org/about-us/security/advisories/cve-2021-25633/

https://www.libreoffice.org/about-us/security/advisories/cve-2021-25634/

Vendor Information

https://www.libreoffice.org/about-us/security/advisories/cve-2021-25632/
https://www.libreoffice.org/about-us/security/advisories/cve-2021-25633/
https://www.libreoffice.org/about-us/security/advisories/cve-2021-25634/

References

CVE Name
CVE-2021-25633
CVE-2021-25633
CVE-2021-25634

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India