CVE-2010-2074

istream.c in w3m 0.5.2 and possibly other versions, when sslverifyserver is enabled, does not properly handle a '\0' character in a domain name in the 1 subject's Common Name or 2 Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary S...

CVE-2010-2074

The CVE-2010-2074 issue affects istream.c in w3m 0.5.2 (and potentially other versions) where, when ssl_verify_server is enabled, a NULL character ('\0') in a certificate’s domain name (CN or SAN) can allow MITM spoofing of SSL servers via a certificate issued by a trusted CA. This is a domain-na...