Skip to content
Fencer Vulns
critical 9.8

CVE-2024-5261 json

TLS certificate are not properly verified when utilizing LibreOfficeKit

published 2024-06-25 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-46499

cvss
9.8
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 37%
public exploits
0
none known

Summary

Improper Certificate Validation vulnerability in LibreOffice "LibreOfficeKit" mode disables TLS certification verification

LibreOfficeKit can be used for accessing LibreOffice functionality through C/C++. Typically this is used by third party components to reuse LibreOffice as a library to convert, view or otherwise interact with documents.

LibreOffice internally makes use of "curl" to fetch remote resources such as images hosted on webservers.

In affected versions of LibreOffice, when used in LibreOfficeKit mode only, then curl's TLS certification verification was disabled (CURLOPT_SSL_VERIFYPEER of false)

In the fixed versions curl operates in LibreOfficeKit mode the same as in standard mode with CURLOPT_SSL_VERIFYPEER of true.

This issue affects LibreOffice before version 24.2.4.

Patch / fix

  • The Document Foundation LibreOffice 24.2.4
  • libreoffice libreoffice 24.2.4
  • libreoffice Debian 14, Debian 13 4:24.2.4-1

debian advisories DEBIAN-CVE-2024-5261

  • libreoffice Ubuntu 24.04 LTS 4:24.2.4-0ubuntu0.24.04.2

ubuntu advisories UBUNTU-CVE-2024-5261

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libreoffice SLE Workstation Extension 15 SP6, SLE Workstation Extension 15 SP5, SLE Module for Package Hub 15 SP6 +3 more 24.8.1.2-150500.20.11.2
  • libreoffice SLE Workstation Extension 12 SP5, SLE Software Development Kit 12 SP5 24.8.1.2-48.64.2

suse advisories SUSE-SU-2024:3577-1SUSE-SU-2024:3576-1

  • libreoffice openSUSE Tumbleweed 24.2.5.2-1.1

opensuse advisories openSUSE-SU-2024:14186-1

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.43% chance of exploitation in the next 30 days, higher than 37% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 10.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA 4.0 10.0 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • The Document Foundation LibreOffice
  • libreoffice libreoffice

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.