18 matches found
MiracleLinux 3 : w3m-0.5.1-17.AXS3 (AXSA:2010-392:01)
The remote MiracleLinux 3 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2010-392:01 advisory. The w3m program is a pager or text file viewer that can also be used as a text-mode Web browser. W3m features include the following: when reading an HTML...
SUSE: Security Advisory (SUSE-SU-2016:3046-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Oracle Linux 5 : w3m (ELSA-2010-0565)
The remote Oracle Linux 5 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2010-0565 advisory. 0.5.1-17 - Resolves:rh604861:Clear execstack requirement also for ia64 architecture 0.5.1-16 - Resolves:rh604861:CVE-2010-2074 w3m: doesn't handle NULL in Commo...
Gentoo Security Advisory GLSA 201210-01 (w3m)
The remote host is missing updates announced in advisory GLSA 201210-01. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...
Scientific Linux Security Update : w3m on SL5.x i386/x86_64
It was discovered that w3m is affected by the previously published 'null prefix attack', caused by incorrect handling of NULL characters in X.509 certificates. If an attacker is able to get a carefully-crafted certificate signed by a trusted Certificate Authority, the attacker could use the...
SuSE 11 / 11.1 Security Update : w3m (SAT Patch Numbers 2560 / 2563)
w3m does not handle embedded NUL characters in the common name and in subject alternative names of X.509 certificates CVE-2010-2074. This update fixes the issue and also turns on verification of x509 certificates by default which was not the case before. %NASLMINLEVEL 70300 C Tenable Network...
SuSE 10 Security Update : w3m (ZYPP Patch Number 7076)
w3m does not handle embedded NUL characters in the common name and in subject alternative names of X.509 certificates CVE-2010-2074. This update fixes the issue and also turns on verification of x509 certificates by default which was not the case before. %NASLMINLEVEL 70300 C Tenable Network...
Ubuntu: Security Advisory (USN-967-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu 6.06 LTS / 8.04 LTS / 9.04 / 9.10 / 10.04 LTS : w3m vulnerability (USN-967-1)
Ludwig Nussel discovered w3m does not properly handle SSL/TLS certificates with NULL characters in the certificate name. An attacker could exploit this to perform a man in the middle attack to view sensitive information or alter encrypted communications. CVE-2010-2074. Note that Tenable Network...
CentOS 5 : w3m (CESA-2010:0565)
Updated w3m packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...
RHEL 5 : w3m (RHSA-2010:0565)
Updated w3m packages that fix one security issue are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...
openSUSE Security Update : w3m (openSUSE-SU-2010:0393-1)
w3m did not handle embedded nul characters in the common name and in subject alternative names of x509 certificates. CVE-2010-2074 has been assigned to this issue. This update also turns on verification of x509 certificates by default which was not the case before. %NASLMINLEVEL 70300 C Tenable...
openSUSE Security Update : w3m (openSUSE-SU-2010:0393-1)
w3m did not handle embedded nul characters in the common name and in subject alternative names of x509 certificates. CVE-2010-2074 has been assigned to this issue. This update also turns on verification of x509 certificates by default which was not the case before. %NASLMINLEVEL 70300 C Tenable...
Fedora 12 : w3m-0.5.2-17.fc12 (2010-10369)
Resolves:rh604864-CVE-2010-2074 w3m: doesn't handle NULL in Common Name properly Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...
openSUSE Security Update : w3m (openSUSE-SU-2010:0393-1)
w3m did not handle embedded nul characters in the common name and in subject alternative names of x509 certificates. CVE-2010-2074 has been assigned to this issue. This update also turns on verification of x509 certificates by default which was not the case before. %NASLMINLEVEL 70300 C Tenable...
Fedora 13 : w3m-0.5.2-18.fc13 (2010-10250)
Resolves:rh604864-CVE-2010-2074 w3m: doesn't handle NULL in Common Name properly Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without...
CVE-2010-2074
istream.c in w3m 0.5.2 and possibly other versions, when sslverifyserver is enabled, does not properly handle a '\0' character in a domain name in the 1 subject's Common Name or 2 Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary S...
CVE-2010-2074
The CVE-2010-2074 issue affects istream.c in w3m 0.5.2 (and potentially other versions) where, when ssl_verify_server is enabled, a NULL character ('\0') in a certificate’s domain name (CN or SAN) can allow MITM spoofing of SSL servers via a certificate issued by a trusted CA. This is a domain-na...