National Cyber-Alert System

Vulnerability Summary for CVE-2007-5965

Overview

QSslSocket in Trolltech Qt 4.3.0 through 4.3.2 does not properly verify SSL certificates, which might make it easier for remote attackers to trick a user into accepting an invalid server certificate for a spoofed service, or trick a service into accepting an invalid client certificate for a user.

Impact

CVSS Severity (version 2.0):

CVSS Version 2 Metrics:

Vendor Statments (disclaimer)

Official Statement from Red Hat (01/08/2008)

Not vulnerable. This issue did not affect versions of qt or qt4 packages as shipped with Red Hat Enterprise Linux 2.1, 3, 4, or 5.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

External Source: CONFIRM

Name: http://trolltech.com/company/newsroom/announcements/press.2007-12-21.2182567220

Type: Patch Information

Hyperlink:http://trolltech.com/company/newsroom/announcements/press.2007-12-21.2182567220

External Source: FEDORA

Name: FEDORA-2007-4354

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00131.html

External Source: FEDORA

Name: FEDORA-2007-4285

Hyperlink:https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00005.html

External Source: MISC

Name: https://bugzilla.redhat.com/show_bug.cgi?id=427232

Hyperlink:https://bugzilla.redhat.com/show_bug.cgi?id=427232

External Source: VUPEN

Name: ADV-2008-0018

Type: Advisory

Hyperlink:http://www.frsirt.com/english/advisories/2008/0018

External Source: SECUNIA

Name: 28321

Type: Advisory

Hyperlink:http://secunia.com/advisories/28321

External Source: SECUNIA

Name: 28228

Type: Advisory

Hyperlink:http://secunia.com/advisories/28228

External Source: UBUNTU

Name: USN-579-1

Hyperlink:http://www.ubuntu.com/usn/usn-579-1

External Source: BID

Name: 27112

Hyperlink:http://www.securityfocus.com/bid/27112

External Source: SUSE

Name: SUSE-SR:2008:002

Hyperlink:http://www.novell.com/linux/security/advisories/suse_security_summary_report.html

External Source: MANDRIVA

Name: MDVSA-2008:042

Hyperlink:http://www.mandriva.com/security/advisories?name=MDVSA-2008:042

External Source: SECUNIA

Name: 28999

Hyperlink:http://secunia.com/advisories/28999

External Source: SECUNIA

Name: 28636

Hyperlink:http://secunia.com/advisories/28636