CVE-2021-25635

Publication date 21 March 2025

Last updated 26 March 2025

Ubuntu priority

Medium

Why this priority?

An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, then modify it to change the signature algorithm to an invalid (or unknown to LibreOffice) algorithm and LibreOffice would incorrectly present such a signature with an unknown algorithm as a valid signature issued by a trusted person This issue affects LibreOffice: from 7.0 before 7.0.5, from 7.1 before 7.1.1.

Read the notes from the security team

Status

Package Ubuntu Release Status
libreoffice 22.04 LTS jammy
Not affected
21.10 impish
Not affected
21.04 hirsute
Not affected
20.04 LTS focal
Not affected
18.04 LTS bionic
Not affected
16.04 LTS xenial Ignored end of standard support
14.04 LTS trusty Ignored end of standard support

Notes

mdeslaur

This CVE is specific to the Microsoft Crypto API backend

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
libreoffice