python: ssl.match_hostname() DoS via certificates with specially crafted hostname wildcard patterns

A denial of service flaw was found in the way Python's SSL module implementation performed matching of certain certificate names. A remote attacker able to obtain a valid certificate that contained multiple wildcard characters could use this flaw to issue a request to validate such a certificate,...

Double free

The Daily Free App @ Amazon aka com.kattanweb.android.dfaa application 1.5.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5944

The Soccer Blitz aka soccer.blitz application 1.06 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5918

The Secret Circle - talk freely aka com.easyxapp.secret application 2.2.00.26 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

nss: IDNA hostname matching code does not follow RFC 6125 recommendation (MFSA 2014-45)

It was found that the implementation of Internationalizing Domain Names in Applications IDNA hostname matching in NSS did not follow the RFC 6125 recommendations. This could lead to certain invalid certificates with international characters to be accepted as valid...

Information disclosure

The MiniInTheBox Online Shopping aka com.miniinthebox.android application 2.0.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5889

The CVE-2014-5889 incident concerns the Android Forums (com.tapatalk.androidforumscom) Android app, version 2.4.4.9, which fails to verify X.509 certificates when connecting to SSL servers. Root cause: improper TLS/SSL validation enabling man-in-the-middle attackers to spoof servers and access se...

Updated libgadu packages fix CVE-2013-4488

Updated libgadu packages fix security vulnerability: Libgadu before 1.12.0 was found to not be performing SSL certificate validation CVE-2013-4488...

MGASA-2014-0375 Updated libgadu packages fix CVE-2013-4488

Updated libgadu packages fix security vulnerability: Libgadu before 1.12.0 was found to not be performing SSL certificate validation CVE-2013-4488...

Ubuntu 14.04 LTS : NSS vulnerability (USN-2343-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-2343-1 advisory. Tyson Smith and Jesse Schwartzentruber discovered that NSS contained a race condition when performing certificate validation. An attacker could use this issue to...

USN-2343-1 nss vulnerability

Tyson Smith and Jesse Schwartzentruber discovered that NSS contained a race condition when performing certificate validation. An attacker could use this issue to cause NSS to crash, resulting in a denial of service, or possibly execute arbitrary code...

CVE-2014-5803

The Towers N' Trolls aka project.android.ftdjni application 1.6.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5768

The CVE-2014-5768 entry concerns the Android app Food Planner (aka dk.boggie.madplan.android) version 4.8.4.3-google. The vulnerability is that the app does not verify X.509 certificates from SSL/TLS servers, enabling man-in-the-middle attackers to spoof servers and obtain sensitive information v...

CVE-2014-5721

The CVE-2014-5721 issue affects Touchnote Postcards (com.touchnote.android) app for Android, version 4.2.7, where the SSL/TLS implementation does not verify X.509 certificates. Root cause: no certificate verification enables man-in-the-middle attackers to spoof servers and capture sensitive infor...

CVE-2014-5573

The Appstros - FREE Gift Cards! aka com.appstros.main application 1.1.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

Design/Logic Flaw

The Hidden Object - Alice Free aka air.com.differencegames.hovisionsofalicefree application 1.0.17 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate...

CVE-2014-5678

The CVE-2014-5678 entry concerns the Android app IQ Test (com.pophub.androidiqtest.free) version 3.3, which fails to verify X.509 certificates when connecting to SSL servers. The root cause is SSL certificate validation being bypassed, enabling MITM attackers to spoof servers and extract sensitiv...

CVE-2014-5578

The CVE-2014-5578 entry describes the Trading 212 FOREX Android app prior to version 2.0.9 failing to verify X.509 certificates from SSL servers. Root cause: improper SSL/TLS certificate validation, enabling MITM attackers to spoof servers and extract sensitive information through a crafted certi...

CVE-2014-5640

The CVE-2014-5640 entry concerns the Android app CM Backup -Restore,Cloud,Photo (com.ijinshan.kbackup) version 1.1.0.135, which fails to verify X.509 certificates when connecting to SSL servers. This allows MITM attackers to spoof servers and access sensitive information via a crafted certificate...

CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix

It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name CN field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially...