CVE-2016-5672 Intel Crosswalk before 19.49.514.5, 20.x before 20.50.533.11, 21.x before 21.51.546.0, and 22.x before 22.51.549.0 interprets a user's acceptance of one invalid X.509 certificate to mean that all inva...
HighCVSS 8.1
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Intel Crosswalk before 19.49.514.5, 20.x before 20.50.533.11, 21.x before 21.51.546.0, and 22.x before 22.51.549.0 interprets a user's acceptance of one invalid X.509 certificate to mean that all invalid X.509 certificates should be accepted without prompting, which makes it easier for man-in-the-middle attackers to spoof SSL servers and obtain sensitive information via a crafted certificate.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| intel crosswalk | <= 19.49.514.4 | No fix listed |
References
- packetstormsecurity.com third-party-advisory vdb-entry
- VU#217871 third-party-advisory us-government-resource
- 20160729 CVE-2016-5672: Intel Crosswalk SSL Prompt Issue mailing-list
- 92199 third-party-advisory vdb-entry
- blogs.intel.com vendor-advisory
- crosswalk-project.org permissions-required technical-description
- [crosswalk-help] 20160728 Crosswalk Security Advisory mailing-list vendor-advisory
- wwws.nightwatchcybersecurity.com third-party-advisory