CVE-2021-25635

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untrusted by the target, then modify it to change the signature algorithm to an invalid (or unknown to LibreOffice) algorithm and LibreOffice would incorrectly present such a signature with an unknown algorithm as a valid signature issued by a trusted person

This issue affects LibreOffice: from 7.0 before 7.0.5, from 7.1 before 7.1.1.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
The Document Foundation	LibreOffice	>= 7.0, < 7.0.5; >= 7.1, < 7.1.1

References

https://www.libreoffice.org/about-us/security/advisories/cve-2021-25635/Vendor Advisory

Timeline

Published: Mar 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2021

CVE-2021-256367.5LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the docum CVE-2021-256406.1In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redi CVE-2021-256419.8Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versio CVE-2021-256428.8ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without v CVE-2021-256434.9An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @CVE-2021-256447.5An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leake CVE-2021-256454.4An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with ad CVE-2021-256468.8Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is inte CVE-2021-256475.4Mobile application "Testes de Codigo" v11.3 and prior allows stored XSS by injecting a payload in the "feedback" message field causing it to CVE-2021-256489.8Mobile application "Testes de Codigo" 11.4 and prior allows an attacker to gain access to the administrative interface and premium features CVE-2021-256495.5An information disclosure vulnerability was discovered in the directory and file management of Avaya Aura Utility Services. This vulnerabili CVE-2021-256508.8A privilege escalation vulnerability was discovered in Avaya Aura Utility Services that may potentially allow a local user to execute specia