Unscored severity · published Oct 14, 2010
CVE-2010-3312
Epiphany 2.28 and 2.29, when WebKit and LibSoup are used, unconditionally displays a closed-lock icon for any URL beginning with the https: substring, without any warning to the…
–
CVSS
1%
EPSS
No
On KEV
Description
Epiphany 2.28 and 2.29, when WebKit and LibSoup are used, unconditionally displays a closed-lock icon for any URL beginning with the https: substring, without any warning to the user, which allows man-in-the-middle attackers to spoof arbitrary https web sites via a crafted X.509 server certificate.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 64% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EP
Epiphany · Gnome
2.28; 2.29 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-3312
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-3312
blog.fefe.de
http://blog.fefe.de/?ts=b26ca29d
bugs.debian.org
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=564690
bugzilla-attachments.gnome.org
http://bugzilla-attachments.gnome.org/attachment.cgi?id=154330
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2010-12/msg00000.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
secunia.com
http://secunia.com/advisories/43068
More from Epiphany
8.1
CVE-2019-6251
WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections
7.5
CVE-2023-26081
In Epiphany (aka GNOME Web) through 43.0, untrusted web content can trick users into exfiltrating passwords, because autofill occurs in sandboxed contexts
7.5
CVE-2022-29536
In GNOME Epiphany before 41.4 and 42.x before 42.2, an HTML document can trigger a client buffer overflow (in ephy_string_shorten in the UI process) via a long page title
7.5
CVE-2018-12016
libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via certain window.open and document.write…
7.5
CVE-2018-11396
ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that…