CVE-2013-7449
EUVD-2013-721321.04.2016, 14:59
The ssl_do_connect function in common/server.c in HexChat before 2.10.2, XChat, and XChat-GNOME does not verify that the server hostname matches a domain name in the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| canonical | ubuntu_linux | 12.04 |
| canonical | ubuntu_linux | 14.04 |
| canonical | ubuntu_linux | 15.10 |
| xchat | xchat | - |
| xchat | xchat_gnome | - |
| hexchat_project | hexchat | 𝑥 ≤ 2.10.1 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| hexchat |
| ||||||||||||||||||||
| xchat |
| ||||||||||||||||||||
| xchat-gnome |
|
Common Weakness Enumeration
References