CVE-2010-2074: Input Validation
istream.c in w3m 0.5.2 and possibly other versions, when sslverifyserver is enabled, does not properly handle a '\0' character in a domain name in the (1) subject's Common Name or (2) Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2074?
CVE-2010-2074 has been classified as a medium severity vulnerability.
How do I fix CVE-2010-2074?
To fix CVE-2010-2074, upgrade to a newer version of w3m that addresses the issue.
What kinds of attacks can exploit CVE-2010-2074?
CVE-2010-2074 can be exploited by man-in-the-middle attackers to spoof arbitrary content.
Which software versions are affected by CVE-2010-2074?
CVE-2010-2074 affects w3m version 0.5.2 and possibly other versions.
What does CVE-2010-2074 vulnerability involve?
CVE-2010-2074 involves improper handling of a '\0' character in domain names within X.509 certificates.