PT-2017-6570

CVE-2015-2330

Published

2015-03-27

Updated

2024-06-15

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WebKitGTK+ versions prior to 2.6.6

Description The issue allows remote attackers to view a secure HTTP request, including secure cookies, due to late TLS certificate verification.

Recommendations For versions prior to 2.6.6, update to version 2.6.6 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information transmitted over secure HTTP requests until the update is applied.

Exploitability

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-295: Improper Certificate Validation

Related identifiers

CVE-2015-2330

ALT-PU-2015-1333

OPENSUSE-SU-2024:10461-1