CVE-2010-3312 Epiphany 2.28 and 2.29, when WebKit and LibSoup are used, unconditionally displays a closed-lock icon for any URL beginning with the https: substring, without any warning to the user, which allows man...
MediumCVSS 5.8
EPSS 1.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Epiphany 2.28 and 2.29, when WebKit and LibSoup are used, unconditionally displays a closed-lock icon for any URL beginning with the https: substring, without any warning to the user, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted X.509 server certificate.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNOME epiphany | = 2.28 | No fix listed |
| GNOME epiphany | = 2.29 | No fix listed |
| debian/epiphany-browser(Debian:12) | < 2.29.91-1 | 2.29.91-1 |
| debian/epiphany-browser(Debian:13) | < 2.29.91-1 | 2.29.91-1 |
| debian/epiphany-browser(Debian:14) | < 2.29.91-1 | 2.29.91-1 |
References
- blog.fefe.de
- bugs.debian.org
- bugzilla-attachments.gnome.org
- SUSE-SR:2010:023 vendor-advisory
- SUSE-SR:2011:002 vendor-advisory
- 43068 third-party-advisory
- [oss-security] 20100917 Re: CVE request: epiphany not checking ssl certs mailing-list
- [oss-security] 20100917 Re: CVE request: epiphany not checking ssl certs mailing-list
- [oss-security] 20100917 Re: CVE request: epiphany not checking ssl certs mailing-list
- [oss-security] 20100917 CVE request: epiphany not checking ssl certs mailing-list
- [oss-security] 20100917 Re: CVE request: epiphany not checking ssl certs mailing-list
- [oss-security] 20100920 Re: CVE request: epiphany not checking ssl certs mailing-list
- [oss-security] 20100921 Re: CVE request: epiphany not checking ssl certs mailing-list
- ADV-2011-0212 vdb-entry
- bugzilla.gnome.org
- Debian Security Tracker CVE-2010-3312 vendor-advisory
- bugs.debian.org issue-tracking