CVE-2024-5261: 
LibreOffice vulnerability analysis and mitigation

A critical vulnerability (CVE-2024-5261) was discovered in LibreOffice's LibreOfficeKit component, affecting versions prior to 24.2.4. LibreOfficeKit, which enables C/C++ applications to access LibreOffice functionalities, was found to have disabled TLS certification verification when fetching remote resources. The vulnerability was discovered by OpenSource Security GmbH on behalf of the German Federal Office for Information Security (LibreOffice Advisory).

The vulnerability stems from an improper certificate validation in LibreOfficeKit mode where curl's CURLOPTSSLVERIFYPEER option was set to false, effectively disabling TLS certificate verification. This affected the component's ability to securely fetch remote resources such as images hosted on webservers. The vulnerability has been assigned a CVSSv4 score of 10.0 (Critical) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H (Security Online).

The vulnerability could allow attackers to intercept or manipulate data transmitted between LibreOffice and remote servers, potentially exposing sensitive information. The disabled TLS certificate verification could lead to man-in-the-middle attacks when LibreOfficeKit accesses remote resources (Security Online).

The vulnerability has been fixed in LibreOffice version 24.2.4, where curl operates in LibreOfficeKit mode with CURLOPTSSLVERIFYPEER set to true, ensuring proper TLS certificate verification. Users are strongly recommended to upgrade to version 24.2.4 or later to address this security issue (LibreOffice Advisory).