Links: SSL verification vulnerability

Background Links is a fast lightweight text and graphic web-browser. Description A SSL verification vulnerability and two unspecified vulnerabilities have been discovered in Links. Please review the Secunia Advisory referenced below for details. Impact An attacker might conduct man-in-the-middle...

UBUNTU-CVE-2012-2126

RubyGems before 1.8.23 does not verify an SSL certificate, which allows remote attackers to modify a gem during installation via a man-in-the-middle attack...

PYSEC-2011-24

libcloud before 0.4.1 does not verify SSL certificates for HTTPS connections, which allows remote attackers to spoof certificates and bypass intended access restrictions via a man-in-the-middle MITM attack...

Fedora 14 : perl-IO-Socket-SSL-1.37-1.fc14 (2010-19058)

This update fixes a problem whereby IO::Socket::SSL fell back to the 'VERIFYNONE' verification mode if another verification mode was defined but no valid cafile or capath was provided. The updated version throws an error in that situation rather than proceeding with the connection despite being...

w3m: doesn't handle NULL in Common Name properly

istream.c in w3m 0.5.2 and possibly other versions, when sslverifyserver is enabled, does not properly handle a '\0' character in a domain name in the 1 subject's Common Name or 2 Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary S...

DEBIAN-CVE-2010-2074

istream.c in w3m 0.5.2 and possibly other versions, when sslverifyserver is enabled, does not properly handle a '\0' character in a domain name in the 1 subject's Common Name or 2 Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary S...

DEBIAN-CVE-2010-1155

Irssi before 0.8.15, when SSL is used, does not verify that the server hostname matches a domain name in the subject's Common Name CN field or a Subject Alternative Name field of the X.509 certificate, which allows man-in-the-middle attackers to spoof IRC servers via an arbitrary certificate...

curl: incorrect verification of SSL certificate with NUL in name

lib/ssluse.c in cURL and libcurl 7.4 through 7.19.5, when OpenSSL is used, does not properly handle a '\0' character in a domain name in the subject's Common Name CN field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate...

PT-2009-2933 · Isc · Bind

Internet Systems Consortium ISC BIND 9.6.0 and earlier does not properly check the return value from the OpenSSL EVP VerifyFinal function, which allows remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077 and...

yum-rhn-plugin: does not verify SSL certificate for all communication with RHN server

yum-rhn-plugin in Red Hat Enterprise Linux RHEL 5 does not verify the SSL certificate for a file download from a Red Hat Network RHN server, which makes it easier for remote man-in-the-middle attackers to cause a denial of service loss of updates or force the download and installation of official...

CVE-2008-3532

The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service...

SUSE-SA:2006:051: apache2

The remote host is missing the patch for the advisory SUSE-SA:2006:051 apache2. The web server Apache2 has been updated to fix several security issues: The security fix for CVE-2005-3357 denial of service broke the earlier security fix for SSL verification CVE-2005-2700. This problem has been...

DEBIAN-CVE-2005-2700

sslenginekernel.c in modssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions...

EUVD-2005-2701

sslenginekernel.c in modssl before 2.8.24, when using "SSLVerifyClient optional" in the global virtual host configuration, does not properly enforce "SSLVerifyClient require" in a per-location context, which allows remote attackers to bypass intended access restrictions...