CVE-2014-5444 Geary before 0.6.3 does not present the user with a warning when a TLS certificate error is detected, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted cert...
MediumCVSS 4.3
EPSS 1.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Geary before 0.6.3 does not present the user with a warning when a TLS certificate error is detected, which makes it easier for remote attackers to conduct man-in-the-middle attacks via a crafted certificate.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/geary(Debian:12) | < 0.6.3-1 | 0.6.3-1 |
| debian/geary(Debian:13) | < 0.6.3-1 | 0.6.3-1 |
| debian/geary(Debian:14) | < 0.6.3-1 | 0.6.3-1 |
| yorba geary | <= 0.5.0 | No fix listed |
References
- Debian Security Tracker CVE-2014-5444 vendor-advisory
- openSUSE-SU-2014:1225 vendor-advisory
- bugzilla.gnome.org
- git.gnome.org patch