Scientific Linux 5.x: CVE-2010-2074 Moderate: w3m Man-in-the-Middle Risk

Date: Tue, 27 Jul 2010 11:23:41 -0500
Reply-To: Troy Dawson 
Sender: Security Errata for Scientific Linux
 
From: Troy Dawson 
Subject: Security ERRATA Moderate: w3m on SL5.x i386/x86_64
Comments: To: "This email address is being protected from spambots. You need JavaScript enabled to view it."
 

Synopsis:	Moderate: w3m security update
Issue date:	2010-07-27
CVE Names:	CVE-2010-2074

It was discovered that w3m is affected by the previously published "null
prefix attack", caused by incorrect handling of NULL characters in X.509
certificates. If an attacker is able to get a carefully-crafted
certificate signed by a trusted Certificate Authority, the attacker
could use the certificate during a man-in-the-middle attack and
potentially confuse w3m into accepting it by mistake. (CVE-2010-2074)

SL 5.x

 SRPMS:
w3m-0.5.1-17.el5_5.src.rpm
 i386:
w3m-0.5.1-17.el5_5.i386.rpm
w3m-img-0.5.1-17.el5_5.i386.rpm
 x86_64:
w3m-0.5.1-17.el5_5.x86_64.rpm
w3m-img-0.5.1-17.el5_5.x86_64.rpm

-Connie Sieh
-Troy Dawson