CVE-2008-3532
CVE-2008-3532
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The NSS plugin in libpurple in Pidgin 2.4.3 does not verify SSL certificates, which makes it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service.
EPSS 1.6% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
Original sources
- http://developer.pidgin.im/attachment/ticket/6500/nss-cert-verify.patch
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18327
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:025
- http://secunia.com/advisories/31390
- http://www.vupen.com/english/advisories/2008/2318
- http://support.avaya.com/elmodocs2/security/ASA-2008-493.htm
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=492434
- http://secunia.com/advisories/33102
- http://www.ubuntu.com/usn/USN-675-1
- http://developer.pidgin.im/attachment/ticket/6500/nss_add_rev.patch
- http://secunia.com/advisories/32859
- http://developer.pidgin.im/ticket/6500
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44220
- http://www.redhat.com/support/errata/RHSA-2008-1023.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10979
- http://www.securityfocus.com/bid/30553
- https://nvd.nist.gov/vuln/detail/CVE-2008-3532