PT-2017-6570 · Webkit+2 · Webkitgtk+2

Ross Lagerwall · Publicado 2015-03-27 · Atualizado 2024-06-15 · CVE-2015-2330

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WebKitGTK+ versions prior to 2.6.6

Description The issue allows remote attackers to view a secure HTTP request, including secure cookies, due to late TLS certificate verification.

Recommendations For versions prior to 2.6.6, update to version 2.6.6 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information transmitted over secure HTTP requests until the update is applied.

Correção

Improper Certificate Validation

Enumeração de Fraquezas

CWE-295

Identificadores relacionados

ALT-PU-2015-1333

CVE-2015-2330

OPENSUSE-SU-2024:10461-1

SUSE-SU-2015:0688-1

Produtos afetados

Alt Linux

Suse

Webkitgtk

Referências · 58

• https://suse.com/security/cve/CVE-2014-1386 · Nota
• https://suse.com/security/cve/CVE-2015-5801 · Nota
• http://openwall.com/lists/oss-security/2015/03/18/4 · Nota
• https://bugzilla.suse.com/879607 · Nota
• https://suse.com/security/cve/CVE-2015-1127 · Nota
• https://suse.com/security/cve/CVE-2015-5822 · Nota
• https://security.gentoo.org/glsa/201706-15 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2014-1389 · Nota
• https://bugzilla.suse.com/866728 · Nota
• https://suse.com/security/cve/CVE-2015-3743 · Nota
• https://suse.com/security/cve/CVE-2015-3659 · Nota
• https://suse.com/security/cve/CVE-2015-5809 · Nota
• https://suse.com/security/cve/CVE-2014-1387 · Nota
• https://suse.com/security/cve/CVE-2015-1071 · Nota
• https://ubuntu.com/security/CVE-2015-2330 · Aviso do Fabricante