kio/kio/tcpslavebase.cpp in KDE KSSL in kdelibs before 4.6.1 does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a certificate issued by a legitimate Certification Authority for an IP address, a different vulnerability than CVE-2009-2702.
CVSS Details
- CVSS 3.1 Base Score: 5.9
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Gentoo Linux | — | Upgrade kde-base/kdelibs. | Oct 30, 2017 | Mar 16, 2011 |
| Oracle_linux | — | Upgrade kdelibs-develUpgrade kdelibs-commonUpgrade kdelibs-apidocsUpgrade kdelibs | Oct 16, 2024 | Mar 16, 2011 |
| Suse | — | Upgrade libkde4Upgrade libkdecore4-develUpgrade kdelibs4-docUpgrade libkdecore4Upgrade kdelibs4Upgrade libksuseinstall-develUpgrade kdelibs4-branding-upstreamUpgrade libksuseinstall1Upgrade libkde4-32bitUpgrade kdelibs4-coreUpgrade libkde4-develUpgrade libksuseinstall1-32bitUpgrade libkdecore4-32bit | Feb 17, 2015 | Mar 16, 2011 |
| Ubuntu | — | Upgrade kdelibs5Upgrade libkhtml5Upgrade libkio5 | Nov 8, 2024 | Mar 16, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub