Description
Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 recognize a wildcard IP address in the subject's Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
References (15)
Core 15
Core References
Mailing List vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html
Vendor Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2010-0782.html
Vendor Advisory vendor-advisory
x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:210
Various Sources x_refsource_confirm
http://blogs.sun.com/security/entry/multiple_vulnerabilities_in_mozilla_firefox
Vendor Advisory vendor-advisory
x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2010-0781.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/42867
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0061
Vendor Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1007-1
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2010/dsa-2123
Vendor Advisory x_refsource_confirm
http://support.avaya.com/css/P8/documents/100114250
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=578697
Vendor Advisory x_refsource_confirm
http://support.avaya.com/css/P8/documents/100120156
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12254
Vendor Advisory x_refsource_confirm
http://www.mozilla.org/security/announce/2010/mfsa2010-70.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/41839
Scores
EPSS
0.0110
EPSS Percentile
61.8%
Details
CWE
CWE-310
Status
published
Products (47)
mozilla/firefox
3.6
mozilla/firefox
3.6.2
mozilla/firefox
3.6.3
mozilla/firefox
3.6.4
mozilla/firefox
3.6.6
mozilla/firefox
3.6.7
mozilla/firefox
3.6.8
mozilla/firefox
3.6.9
mozilla/firefox
3.6.10
mozilla/firefox
1.0 (2 CPE variants)
... and 37 more
Published
Oct 21, 2010
Tracked Since
Feb 18, 2026