UBUNTU-CVE-2021-25633

    Dashboard / Vulnerabilities / UBUNTU-CVE-2021-25633

    UBUNTU-CVE-2021-25633

    Published: 11 Oct 2021Last Modified: 22 Apr 2026
    Upstream:
    CVE-2021-25633
    Aliases:
    USN-5153-1

    Summary:

    Details: LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to create a digitally signed ODF document, by manipulating the documentsignatures.xml or macrosignatures.xml stream within the document to combine multiple certificate data, which when opened caused LibreOffice to display a validly signed indicator but whose content was unrelated to the signature shown. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2.

    References: https://ubuntu.com/security/CVE-2021-25633, https://www.libreoffice.org/about-us/security/advisories/CVE-2021-25633, https://www.openwall.com/lists/oss-security/2021/10/11/1, https://ubuntu.com/security/notices/USN-5153-1, https://www.cve.org/CVERecord?id=CVE-2021-25633

    Affected packages

    Package

    Name: libreoffice

    Purl: pkg:deb/ubuntu/libreoffice@1:6.4.7-0ubuntu0.20.04.2?arch=source&distro=focal

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1:6.4.7-0ubuntu0.20.04.2

    Affected versions

    1:6.3.2-0ubuntu2
    1:6.3.3-0ubuntu1
    1:6.3.3-0ubuntu2
    1:6.3.4-0ubuntu1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2021-25633 | CVE-DB