PT-2010-5154 · Webkit+2 · Webkitgtk+2

Hanno Böck · Published 2010-10-12 · Updated 2011-02-17 · CVE-2010-3900

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Midori versions prior to 0.2.5

Description The issue allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted server certificate, because it does not verify X.509 certificates when using WebKitGTK+ before 1.1.14 or LibSoup before 2.29.91.

Recommendations For Midori versions prior to 0.2.5, update to version 0.2.5 or later to resolve the issue.

Fix

Related Identifiers

CVE-2010-3900

Affected Products

Libsoup

Midori

Webkitgtk

References · 13

• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2010-3900 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2010-3900 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-3900 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3900 · Security Note
• http://vupen.com/english/advisories/2011/0212 · Note
• http://secunia.com/advisories/43068 · Note
• http://git.xfce.org/apps/midori/tree/ChangeLog · Note
• http://twotoasts.de/bugs/index.php?do=details&task_id=168 · Note
• http://twotoasts.de/bugs/index.php?do=details&task_id=743 · Note
• http://openwall.com/lists/oss-security/2010/09/17/6 · Note
• http://omgubuntu.co.uk/2010/05/midori-0-2-5-released · Note
• http://twotoasts.de/index.php?/archives/30-Validation%2C-vending-and-Vala.html · Note