CVE-2007-6591

KDE Konqueror 3.5.5 and 3.95.00, when a user accepts an SSL server
certificate on the basis of the CN domain name in the DN field, regards the
certificate as also accepted for all domain names in subjectAltName:dNSName
fields, even though these fields cannot be examined in the product, which
makes it easier for remote attackers to trick a user into accepting an
invalid certificate for a spoofed web site.

Bugs

• <http://bugs.kde.org/show_bug.cgi?id=154921&gt;
• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=458968&gt;
• <https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2007-6591&gt;

Notes