USN-6877-1: LibreOffice vulnerability

Reference Links

• https://ubuntu.com/security/CVE-2024-5261
• https://launchpad.net/ubuntu/+source/libreoffice/4:24.2.4-0ubuntu0.24.04.2
• https://launchpad.net/ubuntu/+source/libreoffice/4:7.6.7-0ubuntu0.23.10.3
• https://ubuntu.com/security/notices/USN-6877-1 (Advisory)

Child vulnerabilities

(Contains the following vulnerabilities)

• CVE-2024-5261

Frequently Asked Questions

• What is the severity of USN-6877-1?

  The severity of USN-6877-1 is classified as high due to the potential for sensitive information exposure by remote attackers.

• What versions of LibreOffice are affected by USN-6877-1?

  USN-6877-1 affects LibreOffice versions prior to 4:24.2.4-0ubuntu0.24.04.2 for Ubuntu 24.04 and versions prior to 4:7.6.7-0ubuntu0.23.10.3 for Ubuntu 23.10.

• How do I fix USN-6877-1?

  To mitigate USN-6877-1, upgrade LibreOffice to the fixed versions: 4:24.2.4-0ubuntu0.24.04.2 or 4:7.6.7-0ubuntu0.23.10.3, as applicable.

• What is the cause of the vulnerability in USN-6877-1?

  USN-6877-1 is caused by incorrect TLS certificate verification in the LibreOfficeKit library when used by third-party components.

• Can a remote attacker exploit USN-6877-1?

  Yes, a remote attacker could exploit USN-6877-1 to gain access to sensitive information due to the flawed certificate verification.