10

CVE-2024-5261: libreoffice Improper Certificate Validation

CVSS: 10.0v4.0CriticalAnalyzed
AliasesMGASA-2024-0268SUSE-SU-2024:3576-1SUSE-SU-2024:3577-1
Published 25-06-2024Last modified 01-08-2024
Open JSON

Vulnerability summary

CVE-2024-5261 is a critical (CVSS 10.0) Improper Certificate Validation vulnerability in libreoffice. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.7% of scored vulnerabilities.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
10.0/10
010
Critical · v4.0 (CVE.org)
EPSS score
0.43%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 25-06-2024
    PublishedVulnerability first disclosed.
  2. 01-08-2024
    Last modifiedVulnerability information updated.

Description

Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification LibreOfficeKit can be used for accessing LibreOffice functionality through C/C++. Typically this is used by third party components to reuse LibreOffice as a library to convert, view or otherwise interact with documents. LibreOffice internally makes use of "curl" to fetch remote resources such as images hosted on webservers. In affected versions of LibreOffice, when used in LibreOfficeKit mode only, then curl's TLS certification verification was disabled (CURLOPT_SSL_VERIFYPEER of false) In the fixed versions curl operates in LibreOfficeKit mode the same as in standard mode with CURLOPT_SSL_VERIFYPEER of true. This issue affects LibreOffice before version 24.2.4.

CVSS metrics

6 scores · 4 sources · 2 versions

EPSS trend

Probability

0.43%

Chance of exploitation in the next 30 days

Percentile

36%

Versus all other CVEs

30-day change

0.00 pp

From 0.43% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.43%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse6 products
  • libreoffice&distro=SUSE Linux Enterprise Module for Package Hub 15 SP5< 24.8.1.2-150500.20.11.2
  • libreoffice&distro=SUSE Linux Enterprise Module for Package Hub 15 SP6< 24.8.1.2-150500.20.11.2
  • libreoffice&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 24.8.1.2-48.64.2
  • libreoffice&distro=SUSE Linux Enterprise Workstation Extension 12 SP5< 24.8.1.2-48.64.2
  • libreoffice&distro=SUSE Linux Enterprise Workstation Extension 15 SP5< 24.8.1.2-150500.20.11.2
Opensuse3 products
  • libreoffice&distro=openSUSE Leap 15.5< 24.8.1.2-150500.20.11.2
  • libreoffice&distro=openSUSE Leap 15.6< 24.8.1.2-150500.20.11.2
  • libreoffice&distro=openSUSE Tumbleweed< 24.2.5.2-1.1
Debian1 product
  • libreoffice< 4:24.2.4-1
Libreoffice1 product
Mageia1 product
  • libreoffice< 7.6.7.2-1.1.mga9
The document foundation1 product
Ubuntu1 product
  • libreoffice< 4:24.2.4-0ubuntu0.24.04.2

7 vendors · 14 products

References

15 links
Show all 15 references