CVE-2010-3900 Midori before 0.2.5, when WebKitGTK+ before 1.1.14 or LibSoup before 2.29.91 is used, does not verify X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary https web sites vi...
MediumCVSS 5.8
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Midori before 0.2.5, when WebKitGTK+ before 1.1.14 or LibSoup before 2.29.91 is used, does not verify X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted server certificate, a related issue to CVE-2010-3312.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| christian dywan midori | <= 0.2.4 | No fix listed |
| christian dywan midori | = 0.1.10 | No fix listed |
| christian dywan midori | = 0.2.0 | No fix listed |
| christian dywan midori | = 0.2.1 | No fix listed |
| christian dywan midori | = 0.2.2 | No fix listed |
| christian dywan midori | = 0.2.3 | No fix listed |
| debian/midori(Debian:11) | < 0.2.7-1.1 | 0.2.7-1.1 |
References
- git.xfce.org
- SUSE-SR:2011:002 vendor-advisory
- 43068 third-party-advisory
- www.omgubuntu.co.uk
- [oss-security] 20100917 Re: CVE request: epiphany not checking ssl certs mailing-list
- www.twotoasts.de
- www.twotoasts.de
- www.twotoasts.de
- ADV-2011-0212 vdb-entry
- security-tracker.debian.org vendor-advisory