VYPR
← All advisories
Unrated severityNVD Advisory· Published Sep 8, 2009· Updated Jun 16, 2026

CVE-2009-2702

CVE-2009-2702

Description

KDE KSSL in kdelibs 3.5.4, 4.2.4, and 4.3 does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5
  • KDE/Kdelibs3 versions
    cpe:2.3:a:kde:kdelibs:3.5.4:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:kde:kdelibs:3.5.4:*:*:*:*:*:*:*
    • cpe:2.3:a:kde:kdelibs:4.2.4:*:*:*:*:*:*:*
    • cpe:2.3:a:kde:kdelibs:4.3:*:*:*:*:*:*:*
  • KDE/KSSLllm-fuzzy
    Range: = 3.5.4, 4.2.4, 4.3
  • osv-coords
    pkg:deb/debian/kde4libs?arch=source
    Range: < 4:4.3.2-1

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.