| Revision Date: | 2016-05-20 | Version: | 1 | | Title: | CVE-2016-3739 on Ubuntu 16.04 LTS (xenial) - medium. | | Description: | The (1) mbed_connect_step1 function in lib/vtls/mbedtls.c and (2) polarssl_connect_step1 function in lib/vtls/polarssl.c in cURL and libcurl before 7.49.0, when using SSLv3 or making a TLS connection to a URL that uses a numerical IP address, allow remote attackers to spoof servers via an arbitrary valid certificate.
| | Family: | unix | Class: | vulnerability | | Status: | | Reference(s): | CVE-2016-3739
| | Platform(s): | Ubuntu 16.04 LTS
| Product(s): | | | Definition Synopsis | | Ubuntu 16.04 LTS (xenial) is installed. AND Package Information
NOT curl package in xenial, while related to the CVE in some way, is not affected (note: 'gnutls tls backend').
OR NOT libcurl3 package in xenial, while related to the CVE in some way, is not affected (note: 'gnutls tls backend').
OR NOT libcurl3-gnutls package in xenial, while related to the CVE in some way, is not affected (note: 'gnutls tls backend').
OR NOT libcurl3-nss package in xenial, while related to the CVE in some way, is not affected (note: 'gnutls tls backend').
|
|