Vulnerability & Exploit Database

Displaying all 7 entries

Results for: CVE-2015-3455 Back to search

SUSE: CVE-2015-3455: SUSE Linux Security Advisory Vulnerability

  • Severity: 3
  • Published: May 18, 2015

Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate.

Oracle Solaris 11: CVE-2015-3455: Vulnerability in Squid Vulnerability

  • Severity: 3
  • Published: May 18, 2015

Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate.

RHSA-2015:2378: squid security and bug fix update Vulnerability

  • Severity: 3
  • Published: May 18, 2015

Squid is a high-performance proxy caching server for web clients,supporting FTP, Gopher, and HTTP data objects.It was found that Squid configured with client-first SSL-bump did notcorrectly validate X.509 server certificate host name fields. Aman-in-the-middle attacker could use this flaw to spoof a Squid serverusing a specially crafted ...

ELSA-2015-2378 Moderate: Oracle Linux squid security and bug fix update Vulnerability

  • Severity: 3
  • Published: May 18, 2015

Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, does not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate.

Alpine Linux: CVE-2015-3455: squid man-in-the-middle Vulnerability

  • Severity: 3
  • Published: May 18, 2015

Squid 3.2.x before 3.2.14, 3.3.x before 3.3.14, 3.4.x before 3.4.13, and 3.5.x before 3.5.4, when configured with client-first SSL-bump, do not properly validate the domain or hostname fields of X.509 certificates, which allows man-in-the-middle attackers to spoof SSL servers via a valid certificate.