CVE-2011-4129 (1) services/twitter/twitter-contact-view.c and (2) services/twitter/twitter-item-view.c in libsocialweb before 0.25.20 automatically connect to Twitter when no Twitter account is set, which might all...
MediumCVSS 5.8
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
(1) services/twitter/twitter-contact-view.c and (2) services/twitter/twitter-item-view.c in libsocialweb before 0.25.20 automatically connect to Twitter when no Twitter account is set, which might allow remote attackers to obtain sensitive information via a man-in-the-middle (MITM) attack.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| GNOME libsocialweb | <= 0.25.19 | No fix listed |
| GNOME libsocialweb | = 0.25.0 | No fix listed |
| GNOME libsocialweb | = 0.25.1 | No fix listed |
| GNOME libsocialweb | = 0.25.2 | No fix listed |
| GNOME libsocialweb | = 0.25.3 | No fix listed |
| GNOME libsocialweb | = 0.25.4 | No fix listed |
| GNOME libsocialweb | = 0.25.5 | No fix listed |
| GNOME libsocialweb | = 0.25.6 | No fix listed |
| GNOME libsocialweb | = 0.25.7 | No fix listed |
| GNOME libsocialweb | = 0.25.8 | No fix listed |
| GNOME libsocialweb | = 0.25.9 | No fix listed |
| GNOME libsocialweb | = 0.25.10 | No fix listed |
| GNOME libsocialweb | = 0.25.11 | No fix listed |
| GNOME libsocialweb | = 0.25.12 | No fix listed |
| GNOME libsocialweb | = 0.25.13 | No fix listed |
| GNOME libsocialweb | = 0.25.14 | No fix listed |
| GNOME libsocialweb | = 0.25.15 | No fix listed |
| GNOME libsocialweb | = 0.25.16 | No fix listed |
| GNOME libsocialweb | = 0.25.17 | No fix listed |
| GNOME libsocialweb | = 0.25.18 | No fix listed |
References
- git.gnome.org issue-tracking patch
- git.gnome.org issue-tracking patch
- [oss-security] 20111109 CVE Request -- libsocialweb -- Untrusted connection opened to Twitter social service without user's approval upon service start via dbus mailing-list third-party-advisory
- [oss-security] 20111109 Re: CVE Request -- libsocialweb -- Untrusted connection opened to Twitter social service without user's approval upon service start via dbus mailing-list third-party-advisory
- bugzilla.redhat.com issue-tracking