libreoffice openoffice bug allows hackers spoof

Libreoffice openoffice bug allows hackers spoof update#
Libreoffice openoffice bug allows hackers spoof upgrade#
Libreoffice openoffice bug allows hackers spoof download#

Libreoffice openoffice bug allows hackers spoof upgrade#

If you’re using either of the open-source office suites, you’re advised to upgrade to the latest available version immediately. The same flaw impacts LibreOffice, which is a fork of OpenOffice spawned from the main project over a decade ago, and for their project is tracked as CVE-2021-25635. The discovery of the flaw, which is tracked as CVE-2021-41832 for OpenOffice, was the work of four researchers at the Ruhr University Bochum. 'Allowing anyone to sign macro-ridden documents themselves, and make them appear as trustworthy, is an excellent way to trick users into running malicious code. The digital signatures used in document macros are meant to help the user verify that the document hasn’t been altered and can be trusted. It does not store any personal data.LibreOffice and OpenOffice have pushed updates to address a vulnerability that makes it possible for an attacker to manipulate documents to appear as signed by a trusted source.Īlthough the severity of the flaw is classified as moderate, the implications could be dire. The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. The cookie is used to store the user consent for the cookies in the category 'Performance'. This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category 'Necessary'.

The cookie is used to store the user consent for the cookies in the category 'Other. The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category 'Functional'. The cookie is used to store the user consent for the cookies in the category 'Analytics'. These cookies ensure basic functionalities and security features of the website, anonymously.

Necessary cookies are absolutely essential for the website to function properly. You shouldn’t depend on the “trusted list” capability if you’re still running an outdated and vulnerable version since an incorrect signature algorithm may still make a laced document appear to come from a trusted source. You may choose from four different degrees of security in the new dialog, with High or Very High being the preferred selections.

To enable macro security in LibreOffice, go to Tools → Options → LibreOffice → Security, and click on ‘Macro Security.’

Libreoffice openoffice bug allows hackers spoof update#

If you can’t update to the current version for whatever reason, you may permanently disable the macro capabilities in your office suite or avoid trusting any documents that include macros.

Libreoffice openoffice bug allows hackers spoof download#

In that case, you should either download the “deb” or “rpm” package from the Download center or build LibreOffice from the source. Suppose you’re running Linux and the versions mentioned above aren’t yet available through your distribution’s package manager. The auto-updating feature is absent in both applications, so you should manually update to the most recent version. That would be OpenOffice 4.1.10 and later, and LibreOffice 7.0.5 or 7.1.1 and later. If you’re using one of the open-source office suites, you should update to the most recent version right away. The same problem affects LibreOffice, a branch of OpenOffice created from the original project over a decade ago, and is listed as CVE-2021-25635 for their project. Document macros employ digital signatures to let users verify that the document hasn’t been tampered with and can be trusted.Īllowing anybody to sign macro-infested papers and make them look trustworthy is an excellent method to trick people into launching malicious malware.įour researchers from Ruhr University Bochum discovered the OpenOffice issue and assigned the number CVE-2021-41832. Updates for LibreOffice and OpenOffice have been released to address a security flaw that allows an attacker to make documents seem to be signed by a trusted source.Īlthough the vulnerability is classed as mild in severity, the consequences might be severe.