tl:dr upgrade to LibreOffice 7-0 to 7.0.6, libreoffice 7-1 to 7.1.2 (or libreoffice 7.2.0)
LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. The Network and Data Security group at Ruhr University Bochum reported a number of flaws with the implementation of this. CVE-2021-25633 Content Manipulation with Double Certificate Attack https://www.libreoffice.org/about-us/security/advisories/CVE-2021-25633 Fixed in 7.0.6 and 7.1.2 CVE-2021-25634 Timestamp Manipulation with Signature Wrapping https://www.libreoffice.org/about-us/security/advisories/CVE-2021-25634 Fixed in 7.0.6 and 7.1.2 CVE-2021-25635 Content Manipulation with Certificate Validation Attack https://www.libreoffice.org/about-us/security/advisories/CVE-2021-25635 Fixed in 7.0.5 and 7.1.1 -- To unsubscribe e-mail to: discuss+unsubscr...@documentfoundation.org Problems? https://www.libreoffice.org/get-help/mailing-lists/how-to-unsubscribe/ Posting guidelines + more: https://wiki.documentfoundation.org/Netiquette List archive: https://listarchives.documentfoundation.org/www/discuss/ Privacy Policy: https://www.documentfoundation.org/privacy
