kio/kio/tcpslavebase.cpp in KDE KSSL in kdelibs before 4.6.1 does not properly verify that the server hostname matches the domain name of the subject of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a certificate issued by a legitimate Certification Authority for an IP address, a different vulnerability than CVE-2009-2702.
CVSS Details
- CVSS 3.1 Base Score: 5.9
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Gentoo Linux | — | Upgrade kde-base/kdelibs. | Oct 30, 2017 | Mar 16, 2011 |
| Oracle_linux | — | Upgrade kdelibs-commonUpgrade kdelibs-apidocsUpgrade kdelibsUpgrade kdelibs-devel | Oct 16, 2024 | Mar 16, 2011 |
| Suse | — | Upgrade libkdecore4Upgrade kdelibs4-branding-upstreamUpgrade kdelibs4-docUpgrade kdelibs4Upgrade libksuseinstall1Upgrade libkdecore4-develUpgrade libksuseinstall-develUpgrade libkde4Upgrade libkdecore4-32bitUpgrade libkde4-32bitUpgrade libksuseinstall1-32bitUpgrade libkde4-develUpgrade kdelibs4-core | Feb 17, 2015 | Mar 16, 2011 |
| Ubuntu | — | Upgrade libkhtml5Upgrade libkio5Upgrade kdelibs5 | Nov 8, 2024 | Mar 16, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub