PT-2024-6309 · Document Foundation+5 · Libreoffice+5

Michael Stahl + 2 · Published 2024-09-17 · Updated 2025-01-14 · CVE-2024-7788

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LibreOffice versions prior to 24.2.5

Description The issue affects the Zip Repair Mode of LibreOffice, where an improper digital signature invalidation vulnerability allows for signature forgery. This means an attacker could create a specially crafted document that, after repair, would report a valid electronic signature status, potentially deceiving users about the document's authenticity.

Recommendations For versions prior to 24.2.5, update to version 24.2.5 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the Zip Repair Mode until a patch is applied. Restrict access to documents that have been repaired using the vulnerable mode to minimize the risk of exploitation.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

ALT-PU-2024-13526

ALT-PU-2024-14937

ALT-PU-2024-15239

BDU:2024-07260

CVE-2024-7788

DLA-3915-1

DSA-5772-1

USN-7025-1

Affected Products

Alt Linux

Astra Linux

Libreoffice

Linuxmint

Red Os

Ubuntu

References · 33

• https://cve.org/CVERecord?id=CVE-2024-7788 · Security Note
• https://bdu.fstec.ru/vul/2024-07260 · Security Note
• https://osv.dev/vulnerability/USN-7025-1 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-7788 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5772-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-7788 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-7788 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7025-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3915-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-7788 · Vendor Advisory
• https://libreoffice.org/about-us/security/advisories/CVE-2024-7788 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0114SE18MD · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2024-7788 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-7788 · Vendor Advisory