{"id":"CVE-2010-3900","aliases":["DEBIAN-CVE-2010-3900","EUVD-2010-3878","GHSA-x27m-58m8-qvm6"],"status":"published","title":"Midori before 0.2.5, when WebKitGTK+ before 1.1.14 or LibSoup before 2.29.91 is used, does not...","description":"Midori before 0.2.5, when WebKitGTK+ before 1.1.14 or LibSoup before 2.29.91 is used, does not verify X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted server certificate, a related issue to CVE-2010-3312.","severity":{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01245,"percentile":0.69469,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2010-10-12T21:00:00Z","modified":"2026-08-15T06:47:32Z","fixes":[{"ecosystem":"Debian:11","package":"midori","fixed_in":["0.2.7-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:11","package":"midori","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.7-1.1"}]}]}],"products":[{"vendor":"christian_dywan","product":"midori"}],"references":[{"url":"http://secunia.com/advisories/43068","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.twotoasts.de/bugs/index.php?do=details\u0026task_id=168","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.vupen.com/english/advisories/2011/0212","tags":["vdb-entry","x_refsource_VUPEN","x_transferred","advisory"]},{"url":"http://www.omgubuntu.co.uk/2010/05/midori-0-2-5-released/","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://git.xfce.org/apps/midori/tree/ChangeLog","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.twotoasts.de/index.php?/archives/30-Validation%2C-vending-and-Vala.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2010/09/17/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.twotoasts.de/bugs/index.php?do=details\u0026task_id=743","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2010-3900"},{"url":"http://www.twotoasts.de/index.php?/archives/30-Validation,-vending-and-Vala.html"},{"url":"http://www.omgubuntu.co.uk/2010/05/midori-0-2-5-released"},{"url":"https://github.com/advisories/GHSA-x27m-58m8-qvm6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2010-3900","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2010-3900","description":"Midori before 0.2.5, when WebKitGTK+ before 1.1.14 or LibSoup before 2.29.91 is used, does not verify X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted server certificate, a related issue to CVE-2010-3312.","status":"published","published":"2010-10-12T21:00:00Z","modified":"2024-08-07T03:26:11.995Z","updated_at":"2026-11-02T14:33:27.739358Z"}],"euvd":[{"id":"EUVD-2010-3878","description":"Midori before 0.2.5, when WebKitGTK+ before 1.1.14 or LibSoup before 2.29.91 is used, does not verify X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted server certificate, a related issue to CVE-2010-3312.","status":"published","published":"2010-10-12T21:00:00Z","modified":"2024-08-07T03:26:11Z","updated_at":"2026-11-03T01:39:32.539513Z"}],"ghsa":[{"id":"GHSA-x27m-58m8-qvm6","title":"Midori before 0.2.5, when WebKitGTK+ before 1.1.14 or LibSoup before 2.29.91 is used, does not...","description":"Midori before 0.2.5, when WebKitGTK+ before 1.1.14 or LibSoup before 2.29.91 is used, does not verify X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted server certificate, a related issue to CVE-2010-3312.","status":"published","published":"2022-05-17T05:43:24Z","modified":"2025-04-11T03:41:08Z","updated_at":"2026-11-02T15:01:06.818128Z"}],"nvd":[{"id":"CVE-2010-3900","description":"Midori before 0.2.5, when WebKitGTK+ before 1.1.14 or LibSoup before 2.29.91 is used, does not verify X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted server certificate, a related issue to CVE-2010-3312.","status":"published","published":"2010-10-14T05:58:42.863Z","modified":"2026-06-16T23:23:47.157Z","cvss":[{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:01:57.065463Z"}],"osv":[{"id":"CVE-2010-3900","description":"Midori before 0.2.5, when WebKitGTK+ before 1.1.14 or LibSoup before 2.29.91 is used, does not verify X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted server certificate, a related issue to CVE-2010-3312.","status":"published","published":"2010-10-14T05:58:42Z","modified":"2026-04-10T03:41:27.24875Z","updated_at":"2026-11-02T15:43:57.991581Z"},{"id":"DEBIAN-CVE-2010-3900","description":"Midori before 0.2.5, when WebKitGTK+ before 1.1.14 or LibSoup before 2.29.91 is used, does not verify X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted server certificate, a related issue to CVE-2010-3312.","status":"published","published":"2010-10-14T05:58:42.863Z","modified":"2026-08-15T06:47:32.422273707Z","updated_at":"2026-11-02T15:45:24.316685Z"}]}}