CVE-2009-3831

Opera before 10.01 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted domain name...

CVE-2009-3831: Out-of-bounds Write

Opera before 10.01 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption and application crash via a crafted domain name...

Web fonts can be used to spoof the page address

In some cases, a Web font intended to be used for page content could be incorrectly used by Opera to render parts of the user interface, including the address field. This can be used by a malicious site to display a false domain name in the address field...

ProFTPD < 1.3.2b, 1.3.3 - 1.3.3.rc1 SSL Certificate Validation Bypass Vulnerability

ProFTPD is prone to a security bypass vulnerability because the application fails to properly validate the domain name in a signed CA certificate, allowing attackers to substitute malicious SSL certificates for trusted ones. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might b...

DEBIAN-CVE-2009-3767

libraries/libldap/tlso.c in OpenLDAP 2.2 and 2.4, and possibly other versions, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers vi...

Design/Logic Flaw

muttssl.c in mutt 1.5.19 and 1.5.20, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a...

Design/Logic Flaw

muttssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2009-3766

muttssl.c in mutt 1.5.16 and other versions before 1.5.19, when OpenSSL is used, does not verify the domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate...

CVE-2009-3765

CVE-2009-3765 affects mutt (versions 1.5.19/1.5.20) when built with OpenSSL: it mishandles a '\0' in the domain name of the X.509 certificate’s CN, enabling MITM spoofing of SSL servers via certificates from a legitimate CA. The vulnerability is described as related to CVE-2009-2408. The provided...

CVE-2009-3765

muttssl.c in mutt 1.5.19 and 1.5.20, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a...

'Avalanche' Crimeware Kit Fuels Phishing Attacks

A single cybercrime group called “Avalanche” was responsible for nearly one-quarter of all identity theft-related phishing attacks in the first half of 2009, according to a new report by the Anti-Phishing Work Group APWG. According to the report, phishing sites on Avalanche domains target the...

Outlook Web Access Attack Using Pushdo Botnet

Here are some technical details on the Outlook Web Access phishing scheme. 1. The Spam According to our preliminary research, the spam emails which attacked OWA users, including Kaspersky, were sent using the pushdo botnet – which is based on malware from the Backdoor.Win32.NewRes family. These...

DEBIAN-CVE-2009-3490

GNU Wget before 1.12 does not properly handle a '\0' character in a domain name in the Common Name field of an X.509 certificate, which allows man-in-the-middle remote attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issu...

Design/Logic Flaw

Apple Safari, possibly before 4.0.3, on Mac OS X does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate...

Microsoft Windows DNS Devolution Third-Level Domain Name Resolving Weakness (971888)

This host has Microsoft DNS Devolution and is prone to Third-Level Domain Name Resolving Weakness. OpenVAS Vulnerability Test $Id: secpodmsdnsdevolutionresolvingweakness.nasl 5363 2017-02-20 13:07:22Z cfi $ Microsoft Windows DNS Devolution Third-Level Domain Name Resolving Weakness 971888 Authors...

neon: Improper verification of x509v3 certificate with NULL (zero) byte in certain fields

neon before 0.28.6, when OpenSSL or GnuTLS is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate...

Nokia Trolltech Qt4 SSL certificate spoofing

certificate spoofing with 0 symbol in domain name...

CVE-2009-2702

Removed by vendor...

CVE-2009-2702: Undefined Security Weakness

KDE KSSL in kdelibs 3.5.4, 4.2.4, and 4.3 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certificatio...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation src/network/ssl/qsslcertificate.cpp in Nokia Trolltech Qt 4.x does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows...