libreoffice libreoffice CVE-2021-25634 in LibreOffice and Debian Products
Published on October 12, 2021

Timestamp Manipulation with Signature Wrapping

product logo product logo
LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to modify a digitally signed ODF document to insert an additional signing time timestamp which LibreOffice would incorrectly present as a valid signature signed at the bogus signing time. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2.

Vendor Advisory NVD

Weakness Type

Improper Certificate Validation

The software does not validate, or incorrectly validates, a certificate. When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The software might connect to a malicious host while believing it is a trusted host, or the software might be deceived into accepting spoofed data that appears to originate from a trusted host.


Products Associated with CVE-2021-25634

stack.watch emails you whenever new vulnerabilities are published in LibreOffice or Debian Linux. Just hit a watch button to start following.

LibreOffice
 
Debian Linux
 

Affected Versions

The Document Foundation LibreOffice:

Exploit Probability

EPSS
0.71%
Percentile
51.59%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.