Open a LibreOffice application, e.g., LibreOffice Writer.To check or change the macro security setting, do the following: The exploit does not work if no trusted certificates are stored in LibreOffice or if the macro security level is set to very high. LibreOffice could then allow the execution of macros that are not signed using the trusted certificate this could lead to the execution of arbitrary code on the system using macros that are not trusted. LibreOffice matched 'the serial number and issuer string of the used certificate with that of a trusted certificate' only, which is insufficient.Īn attacker could create an arbitrary certificate that matches the serial number and issuer string of a trusted certificate that LibreOffice uses. Security researchers detected an issue in the certification validation algorithm that LibreOffice uses.

The macro is executed if a matching certificate is found, and blocked otherwise. When a document contains macros, LibreOffice attempts to match the certificate to the list of trusted certificates. LibreOffice maintains a list of trusted certificates that are stored in the user's configuration database. LibreOffice supports the execution of macros, but limits the execution to macros to documents that are either stored in a trusted file location or are signed by a trusted certificate. CVE-2022-26306 - Static Initialization Vector Allows to Recover Passwords for Web Connections Without Knowing the Master PasswordĮxecution of Untrusted Macros Due to Improper Certificate Validation.CVE-2022-26305 - Execution of Untrusted Macros Due to Improper Certificate Validation.

Libreoffice vs openoffice security