Approved changes feed: RSS · Atom
cpe:2.3:a:stafford.uklinux:libesmtp:0.8.10:p1:*:*:*:*:*:*part: a version: 0.8.10 update: p1
| Vendor | Stafford.Uklinux (b5d5a31a-717f-5a90-bec5-9e5f5c863b57) |
|---|---|
| Product | Libesmtp (559bba04-ca2d-5208-911d-002dabf2d989) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/jbouse-debian/libesmtp |
purl2cpe | 2026-06-01 10:16:02.687023 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2010-1194 |
vulnerable | 2026-06-08 04:54:06.188887 |
Details available
The match_component function in smtp-tls.c in libESMTP 1.0.3.r1, and possibly other versions including 1.0.4, treats two strings as equal if one is a substring of the other, which allows remote attackers to spoof trusted certificates via a crafted subjectAltName.
Published: 2010-03-31T17:35:00.000Z
Updated: 2024-08-07T01:14:06.680Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2010-1192 |
vulnerable | 2026-06-08 04:54:06.182463 |
Details available
libESMTP, probably 1.0.4 and earlier, does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Published: 2010-03-31T17:35:00.000Z
Updated: 2024-08-07T01:14:06.660Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.