QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2013-4248

Back to search

CVE-2013-4248

Published: Aug 18, 2013

Modified: Aug 6, 2024

PUBLISHED

Description

The openssl_x509_parse function in openssl.c in the OpenSSL module in PHP before 5.4.18 and 5.5.x before 5.5.2 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

VendorProductVersions

n/a

n/a

affected
n/a

References

54657
third-party-advisory
x_refsource_SECUNIA
DSA-2742
vendor-advisory
x_refsource_DEBIAN
openSUSE-SU-2013:1964
vendor-advisory
x_refsource_SUSE
61776
vdb-entry
x_refsource_BID
59652
third-party-advisory
x_refsource_SECUNIA
55078
third-party-advisory
x_refsource_SECUNIA
HPSBUX03150
vendor-advisory
x_refsource_HP
USN-1937-1
vendor-advisory
x_refsource_UBUNTU
54478
third-party-advisory
x_refsource_SECUNIA
RHSA-2013:1307
vendor-advisory
x_refsource_REDHAT
1028924
vdb-entry
x_refsource_SECTRACK
openSUSE-SU-2013:1963
vendor-advisory
x_refsource_SUSE
RHSA-2013:1615
vendor-advisory
x_refsource_REDHAT

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now