PT-2025-18010 · Document Foundation+5 · Libreoffice+5

Juraj Šarinay · Published 2025-04-27 · Updated 2025-12-15 · CVE-2025-2866

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LibreOffice versions 24.8 through 24.8.5 LibreOffice versions 25.2 through 25.2.1

Description The issue is related to an Improper Verification of Cryptographic Signature, allowing PDF Signature Spoofing by Improper Validation. A flaw in the verification code for adbe.pkcs7.sha1 signatures could cause invalid signatures to be accepted as valid.

Recommendations For LibreOffice versions 24.8 through 24.8.5, update to version 24.8.6 or later. For LibreOffice versions 25.2 through 25.2.1, update to version 25.2.2 or later.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

ALT-PU-2025-7908

BDU:2025-05910

CVE-2025-2866

DLA-4205-1

DSA-5908-1

MGASA-2025-0154

USN-7504-1

Affected Products

Alt Linux

Astra Linux

Debian

Libreoffice

Linuxmint

Ubuntu

References · 34

• https://libreoffice.org/about-us/security/advisories/cve-2025-2866 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7504-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-2866 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4205-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-2866 · Security Note
• https://advisories.mageia.org/MGASA-2025-0154.html · Security Note
• https://osv.dev/vulnerability/USN-7504-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-2866 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-2866 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05910 · Security Note
• https://osv.dev/vulnerability/MGASA-2025-0154 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2866 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0923SE17 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-2866 · Vendor Advisory