6.8

CVE-2010-2074

istream.c in w3m 0.5.2 and possibly other versions, when ssl_verify_server is enabled, does not properly handle a '\0' character in a domain name in the (1) subject's Common Name or (2) Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
W3m ≫ W3m Version0.5.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.49% 0.708
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.8 8.6 6.4
AV:N/AC:M/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://lists.opensuse.org/opensuse-security-announce/2010-08/msg00001.html
http://lists.fedoraproject.org/pipermail/package-announce/2010-July/044401.html
http://osvdb.org/65538
http://secunia.com/advisories/40134
Vendor Advisory
http://secunia.com/advisories/40733
http://www.openwall.com/lists/oss-security/2010/06/14/4
http://www.redhat.com/support/errata/RHSA-2010-0565.html
http://www.securityfocus.com/bid/40837
http://www.securitytracker.com/id?1024252
http://www.vupen.com/english/advisories/2010/1467
Vendor Advisory
http://www.vupen.com/english/advisories/2010/1879
http://www.vupen.com/english/advisories/2010/1928