CVE-2022-26305

NameCVE-2022-26305
DescriptionAn Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching the serial number and issuer string of the used certificate with that of a trusted certificate. This is not sufficient to verify that the macro was actually signed with the certificate. An adversary could therefore create an arbitrary certificate with a serial number and an issuer string identical to a trusted certificate which LibreOffice would present as belonging to the trusted author, potentially leading to the user to execute arbitrary code contained in macros improperly trusted. This issue affects: The Document Foundation LibreOffice 7.2 versions prior to 7.2.7; 7.3 versions prior to 7.3.1.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3368-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
libreoffice (PTS)buster1:6.1.5-3+deb10u7vulnerable
buster (security)1:6.1.5-3+deb10u12fixed
bullseye1:7.0.4-4+deb11u8fixed
bullseye (security)1:7.0.4-4+deb11u9fixed
bookworm4:7.4.7-1+deb12u1fixed
bookworm (security)4:7.4.7-1+deb12u2fixed
trixie4:24.2.3-2fixed
sid4:24.2.4-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
libreofficesourcebuster1:6.1.5-3+deb10u8DLA-3368-1
libreofficesourcebullseye1:7.0.4-4+deb11u2
libreofficesource(unstable)1:7.3.2~rc2-1

Notes

https://www.libreoffice.org/about-us/security/advisories/cve-2022-26305

Search for package or bug name: Reporting problems