{"id":"CVE-2014-5704","aliases":["EUVD-2014-5591","GHSA-qpjh-g57v-5xhp","MGASA-2014-0527"],"status":"published","title":"The DISH Anywhere (aka com.sm.SlingGuide.Dish) application 3.5.10 for Android does not verify X...","description":"The DISH Anywhere (aka com.sm.SlingGuide.Dish) application 3.5.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.","severity":{"version":"2.0","score":5.4,"vector":"AV:A/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00355,"percentile":0.29482,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-310"],"published":"2014-09-09T10:00:00Z","modified":"2026-06-17T00:11:55Z","affected":[{"source":"osv","ecosystem":"Mageia:4","package":"apache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.7-5.4.mga4"}]}],"bundled":2}],"products":[{"vendor":"dish","product":"dish_anywhere"}],"references":[{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.kb.cert.org/vuls/id/889617","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","US Government Resource"]},{"url":"http://www.kb.cert.org/vuls/id/582497","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://docs.google.com/spreadsheets/d/1t5GXwjw82SyunALVJb2w0zi3FoLRIkfGPc7AMjRF0r4/edit?usp=sharing","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-5704"},{"url":"https://github.com/advisories/GHSA-qpjh-g57v-5xhp"},{"url":"https://advisories.mageia.org/MGASA-2014-0527.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1141950","tags":["report"]},{"url":"https://rhn.redhat.com/errata/RHSA-2014-1972.html","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-5704","description":"The DISH Anywhere (aka com.sm.SlingGuide.Dish) application 3.5.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.","status":"published","published":"2014-09-09T10:00:00Z","modified":"2024-08-06T11:55:48.658Z","updated_at":"2026-11-02T14:33:41.889751Z"}],"euvd":[{"id":"EUVD-2014-5591","description":"The DISH Anywhere (aka com.sm.SlingGuide.Dish) application 3.5.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.","status":"published","published":"2014-09-09T10:00:00Z","modified":"2024-08-06T11:55:48Z","updated_at":"2026-11-03T01:57:02.222374Z"}],"ghsa":[{"id":"GHSA-qpjh-g57v-5xhp","title":"The DISH Anywhere (aka com.sm.SlingGuide.Dish) application 3.5.10 for Android does not verify X...","description":"The DISH Anywhere (aka com.sm.SlingGuide.Dish) application 3.5.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.","status":"published","published":"2022-05-17T03:53:11Z","modified":"2023-01-28T05:00:40Z","updated_at":"2026-11-02T14:43:23.362712Z"}],"nvd":[{"id":"CVE-2014-5704","description":"The DISH Anywhere (aka com.sm.SlingGuide.Dish) application 3.5.10 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.","status":"published","published":"2014-09-09T10:55:08.473Z","modified":"2026-06-17T00:11:55.973Z","cvss":[{"version":"2.0","score":5.4,"vector":"AV:A/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:55.540337Z"}],"osv":[{"id":"MGASA-2014-0527","title":"Updated apache packages fix security vulnerabilities","description":"Updated apache packages fix security vulnerabilities:\n\nA NULL pointer dereference flaw was found in the way the mod_cache httpd\nmodule handled Content-Type headers. A malicious HTTP server could cause\nthe httpd child process to crash when the Apache HTTP server was configured\nto proxy to a server with caching enabled (CVE-2014-3581).\n\nA flaw was found in the way httpd handled HTTP Trailer headers when\nprocessing requests using chunked encoding. A malicious client could use\nTrailer headers to set additional HTTP headers after header processing was\nperformed by other modules. This could, for example, lead to a bypass of\nheader restrictions defined with mod_headers (CVE-2013-5704).\n\nNote: With this update, httpd has been modified to not merge HTTP Trailer\nheaders with other HTTP request headers. A newly introduced configuration\ndirective MergeTrailers can be used to re-enable the old method of\nprocessing Trailer headers, which also re-introduces the aforementioned\nflaw.\n\nThis update also fixes the following bug:\n\nPrior to this update, the mod_proxy_wstunnel module failed to set up an\nSSL connection when configured to use a back end server using the \"wss:\"\nURL scheme, causing proxied connections to fail. In these updated packages,\nSSL is used when proxying to \"wss:\" back end servers (rhbz#1141950).\n","status":"published","published":"2014-12-13T20:16:05Z","modified":"2026-04-16T06:23:49.664371311Z","updated_at":"2026-11-02T15:49:39.488462Z"}]}}