CVE-2021-25636

LibreOffice supports digital signatures of ODF documents and macros within
documents, presenting visual aids that no alteration of the document
occurred since the last signing and that the signature is valid. An
Improper Certificate Validation vulnerability in LibreOffice allowed an
attacker to create a digitally signed ODF document, by manipulating the
documentsignatures.xml or macrosignatures.xml stream within the document to
contain both “X509Data” and “KeyValue” children of the “KeyInfo” tag, which
when opened caused LibreOffice to verify using the “KeyValue” but to report
verification with the unrelated “X509Data” value. This issue affects: The
Document Foundation LibreOffice 7.2 versions prior to 7.2.5.

Bugs

• <https://bugzilla.redhat.com/show_bug.cgi?id=2056955&gt;