CVE-2024-7788: Signatures in "repair mode" should not be trusted
Improper Digital Signature Invalidation vulnerability in Zip Repair Mode of The Document Foundation LibreOffice allows Signature forgery vulnerability in LibreOfficeThis issue affects LibreOffice: from 24.2 before < 24.2.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libreofficeto a version that resolves this vulnerability.Fixed in 4:7.4.7-1+deb12u5 - Upgrade
Upgrade
debian/libreofficeto a version that resolves this vulnerability.Fixed in 4:24.2.5-1 - Upgrade
Upgrade
debian/libreofficeto a version that resolves this vulnerability.Fixed in 4:7.4.7-1+deb12u14Fixed in 4:7.4.7-1+deb12u13Fixed in 4:25.2.3-2+deb13u6Fixed in 4:25.2.3-2+deb13u9Fixed in 4:26.8.2.2-2 - Upgrade
Upgrade
LibreOfficeto a version that resolves this vulnerability.Fixed in 24.2.5 - Compensating control
Do not trust signatures in repair mode.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7788?
CVE-2024-7788 is classified as a moderate severity vulnerability due to the potential for signature forgery.
How do I fix CVE-2024-7788?
To fix CVE-2024-7788, upgrade LibreOffice to versions 24.2.5 or later.
What versions of LibreOffice are affected by CVE-2024-7788?
CVE-2024-7788 affects LibreOffice versions from 24.2.0 to prior than 24.2.5.
What impact does CVE-2024-7788 have on document security?
CVE-2024-7788 allows for possible signature forgery, compromising the integrity of documents.
Is there a workaround for CVE-2024-7788?
The recommended approach for CVE-2024-7788 is to upgrade to a protected version rather than relying on a workaround.