4.3

CVE-2011-1094

kio/kio/tcpslavebase.cpp in KDE KSSL in kdelibs before 4.6.1 does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a certificate issued by a legitimate Certification Authority for an IP address, a different vulnerability than CVE-2009-2702.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redhat ≫ Kdelibs Version <= 4.6
Redhat ≫ Kdelibs Version3.5.2
Redhat ≫ Kdelibs Version3.5.9
Redhat ≫ Kdelibs Version3.5.10
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1% 0.582
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://openwall.com/lists/oss-security/2011/03/08/13
Patch
http://openwall.com/lists/oss-security/2011/03/08/20
Patch
http://secunia.com/advisories/44108
http://www.mandriva.com/security/advisories?name=MDVSA-2011:071
http://www.securityfocus.com/bid/46789
http://www.ubuntu.com/usn/USN-1110-1
http://www.vupen.com/english/advisories/2011/0913
http://www.vupen.com/english/advisories/2011/0990
https://exchange.xforce.ibmcloud.com/vulnerabilities/65986
https://projects.kde.org/projects/kde/kdelibs/repository/revisions/76f935197599a335a5fe09b78751ddb455248cf7
Patch