CVE-2010-3900

MEDIUM 5.8CVE-2010-3900 · Published 14/10/2010 · updated 16/06/2026

In short

CVE-2010-3900 is a MEDIUM (CVSS 5.8) vulnerability affecting midori (christian dywan).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 69.5% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
midori christian_dywan	`= 0.1.10= 0.2.0= 0.2.1= 0.2.2= 0.2.3≤ 0.2.4`	No fix yet

Description

Midori before 0.2.5, when WebKitGTK+ before 1.1.14 or LibSoup before 2.29.91 is used, does not verify X.509 certificates, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted server certificate, a related issue to CVE-2010-3312.

References

git.xfce.org/apps/midori/tree/ChangeLog
lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
secunia.com/advisories/43068
omgubuntu.co.uk/2010/05/midori-0-2-5-released
openwall.com/lists/oss-security/2010/09/17/6
twotoasts.de/bugs/index.php
twotoasts.de/bugs/index.php
twotoasts.de/index.php
vupen.com/english/advisories/2011/0212

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free