CVE-2010-3170

Publication date 20 October 2010

Last updated 24 July 2024

Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 recognize a wildcard IP address in the subject’s Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.

Read the notes from the security team

Status

Show unmaintained releases

No maintained releases are affected by this CVE.

Package	Ubuntu Release	Status
nspr	10.10 maverick	Not affected
	10.04 LTS lucid	Not affected
	9.10 karmic	Not affected
	9.04 jaunty	Not affected
	8.04 LTS hardy	Not affected
	6.06 LTS dapper	Not in release
nss	10.10 maverick	Fixed 3.12.8-0ubuntu0.10.10.1
	10.04 LTS lucid	Fixed 3.12.8-0ubuntu0.10.04.1
	9.10 karmic	Fixed 3.12.8-0ubuntu0.9.10.1
	9.04 jaunty	Fixed 3.12.8-0ubuntu0.9.04.1
	8.04 LTS hardy	Fixed 3.12.8-0ubuntu0.8.04.1
	6.06 LTS dapper	Not in release

Notes

jdstrand

real problem but with very unlikely circumstances needs new NSPR

References

Related Ubuntu Security Notices (USN)

USN-1007-1
NSS vulnerabilities
20 October 2010

Other references

https://www.cve.org/CVERecord?id=CVE-2010-3170