CVE-2016-20011

June 8, 2021

libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.

Summary:

libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.

Reference Links(if available):

  • https://bugzilla.gnome.org/show_bug.cgi?id=772647
  • https://gitlab.gnome.org/GNOME/libgrss/-/issues/4
  • https://gitlab.gnome.org/GNOME/libgrss/-/merge_requests/7.patch

  • CVSS Score (if available)

    v2: / MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N

    v3: / HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

    Links to Exploits(if available)

  • You may have missed

    image

    [HUNTERS] – Ransomware Victim: A&O IT Group

    November 15, 2024
    image

    [RANSOMHUB] – Ransomware Victim: www[.]gob[.]mx

    November 15, 2024
    image

    [EVEREST] – Ransomware Victim: Bio-Clima Service Srl

    November 15, 2024
    image

    [FOG] – Ransomware Victim: Vector Transport (vectortransport[.]com)

    November 15, 2024
    image

    [EVEREST] – Ransomware Victim: A Sensitive Touch Home Health;Alphastar Home Health Care;Heart of Texas Home Healthcare Se

    November 15, 2024