CVE-2024-5261
Severity CVSS v4.0:
CRITICAL
Type:
CWE-295
Improper Certificate Validation
Publication date:
25/06/2024
Last modified:
23/12/2025
Description
Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification<br />
<br />
LibreOfficeKit can be used for accessing LibreOffice functionality <br />
through C/C++. Typically this is used by third party components to reuse<br />
LibreOffice as a library to convert, view or otherwise interact with <br />
documents.<br />
<br />
LibreOffice internally makes use of "curl" to fetch remote resources such as images hosted on webservers.<br />
<br />
In<br />
affected versions of LibreOffice, when used in LibreOfficeKit mode <br />
only, then curl&#39;s TLS certification verification was disabled <br />
(CURLOPT_SSL_VERIFYPEER of false)<br />
<br />
In the fixed versions curl operates in LibreOfficeKit mode the same as in standard mode with CURLOPT_SSL_VERIFYPEER of true.<br />
<br />
This issue affects LibreOffice before version 24.2.4.
Impact
Base Score 4.0
10.00
Severity 4.0
CRITICAL
Base Score 3.x
9.80
Severity 3.x
CRITICAL
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:libreoffice:libreoffice:*:*:*:*:*:*:*:* | 24.2.4 (excluding) |
To consult the complete list of CPE names with products and versions, see this page