CVE-2007-5965: Undefined Security Weakness

QSslSocket in Trolltech Qt 4.3.0 through 4.3.2 does not properly verify SSL certificates, which might make it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service, or trick a service into accepting an invalid client certificate for a user...

Design/Logic Flaw

KDE Konqueror 3.5.5 and 3.95.00, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all domain names in subjectAltName:dNSName fields, even though these fields cannot be examined in the product, which make...

CVE-2007-6591

KDE Konqueror 3.5.5 and 3.95.00, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all domain names in subjectAltName:dNSName fields, even though these fields cannot be examined in the product, which make...

Code injection

Apple Safari 2, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all domain names in subjectAltName:dNSName fields, which makes it easier for remote attackers to trick a user into accepting an invalid...

CVE-2007-6591

KDE Konqueror 3.5.5 and 3.95.00, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all domain names in subjectAltName:dNSName fields, even though these fields cannot be examined in the product, which make...

CVE-2007-6591

KDE Konqueror 3.5.5 and 3.95.00, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all domain names in subjectAltName:dNSName fields, even though these fields cannot be examined in the product, which make...

CVE-2007-6592

Apple Safari 2, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all domain names in subjectAltName:dNSName fields, which makes it easier for remote attackers to trick a user into accepting an invalid...

CVE-2007-6591: Undefined Security Weakness

KDE Konqueror 3.5.5 and 3.95.00, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all domain names in subjectAltName:dNSName fields, even though these fields cannot be examined in the product, which make...

CVE-2007-6592: Undefined Security Weakness

Apple Safari 2, when a user accepts an SSL server certificate on the basis of the CN domain name in the DN field, regards the certificate as also accepted for all domain names in subjectAltName:dNSName fields, which makes it easier for remote attackers to trick a user into accepting an invalid...

openSUSE 10 Security Update : ruby (ruby-4703)

This update of ruby improves the SSL certificate verification process. CVE-2007-5162, CVE-2007-5770 Prior to this update it was possible to intercept SSL traffic with a man-in-the-middle attack. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

[SECURITY] [DSA 1412-1] New ruby1.9 packages fix insecure SSL certificate validation

------------------------------------------------------------------------ Debian Security Advisory DSA-1412-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 24, 2007 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1411-1] New libopenssl-ruby packages fix insecure SSL certificate validation

------------------------------------------------------------------------ Debian Security Advisory DSA-1411-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 24, 2007 http://www.debian.org/security/faq -...

[SECURITY] [DSA 1410-1] New ruby1.8 packages fix insecure SSL certificate validation

------------------------------------------------------------------------ Debian Security Advisory DSA-1410-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff November 24, 2007 http://www.debian.org/security/faq -...

DSA-1411-1 libopenssl-ruby - possible man-in-the-middle attacks

Bulletin has no description...

Moderate: ruby security update

1.8.5-5.el51.1 - security fix for CVE-2007-5162 and CVE-2007-5770 - ruby-1.8.5-CVE-2007-5162.patch: fix issues that is insufficient verification of SSL certificate. 320331 - Fix the multilib regression issue. 1.8.5-5 - security fix release. - ruby-1.8.5-cgi-CVE-2006-6303.patch: fix a infinite loo...

Ruby多个库SSL多个不安全证书验证漏洞

BUGTRAQ ID: 26421 CVE ID:CVE-2007-5770 CNCVE ID:CNCVE-20075770 Yukihiro Matsumoto Ruby是一种解释型的方便快捷的面向对象脚本语言。 Ruby包含的多个库在对X.509证书验证存在问题，远程攻击者可以利用漏洞进行中间人攻击，获得敏感信息。 多个Ruby Net模块处理SSL证书验证存在问题，库没有对SSL服务器证书中的common name CN的请求的主机名进行检查，可导致中间人攻击。攻击者借此可嗅探到敏感信息。 Yukihiro Matsumoto Ruby 1.8.6 Yukihiro Matsumo...

CVE-2007-4680

CFNetwork in Apple Mac OS X 10.3.9 and 10.4 through 10.4.10 does not properly validate certificates, which allows remote attackers to spoof trusted SSL certificates via a man-in-the-middle attack...

CVE-2007-5770: Improper Authentication

The 1 Net::ftptls, 2 Net::telnets, 3 Net::imap, 4 Net::pop, and 5 Net::smtp libraries in Ruby 1.8.5 and 1.8.6 do not verify that the commonName CN field in a server certificate matches the domain name in a request sent over SSL, which makes it easier for remote attackers to intercept SSL...

RHEL 5 : ruby (RHSA-2007:0965)

Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an interpreted scripting language for object-oriented programming. An SSL certifica...

RHEL 4 : ruby (RHSA-2007:0961)

Updated ruby packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Ruby is an interpreted scripting language for object-oriented programming. A flaw was...