CVE-2024-5261

LibreOffice internally uses the curl library to download remote resources, such as images hosted on web servers. In vulnerable versions, when LibreOffice operated in LibreOfficeKit mode, the curl option CURLOPT_SSL_VERIFYPEER was set to false, which meant complete bypass of TLS server certificate verification. An attacker capable of performing a man-in-the-middle attack could impersonate any remote server without detection by the application. In patched versions, LibreOfficeKit mode operates identically to standard mode — with the CURLOPT_SSL_VERIFYPEER option enabled and set to true.

An attacker can perform a man-in-the-middle attack by intercepting or modifying resources downloaded by LibreOffice (e.g., remote images), and potentially inject malicious content into processed documents. The lack of server identity verification exposes the confidentiality and integrity of data transmitted over encrypted TLS connections.

LibreOffice should be updated to version 24.2.4 or newer, in which the CURLOPT_SSL_VERIFYPEER option is properly set to true also in LibreOfficeKit mode. Details are available in the vendor's security advisory: https://www.libreoffice.org/about-us/security/advisories/cve-2024-5261

LibreOffice versions prior to 24.2.4, exclusively in LibreOfficeKit mode (used by external components using LibreOffice as a C/C++ library)