FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2013-6628

This CVE name corresponds to:

Entered Topic
2013-11-12 chromium -- multiple vulnerabilities

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

Details

Type Candidate
Name CVE-2013-6628
Phase Assigned(20131105)

Description

net/socket/ssl_client_socket_nss.cc in the TLS implementation in Google Chrome before 31.0.1650.48 does not ensure that a server's X.509 certificate is the same during renegotiation as it was before renegotiation, which might allow remote web servers to interfere with trust relationships by renegotiating a session.

References

Source Reference
MISC https://secure-resumption.com/
CONFIRM http://googlechromereleases.blogspot.com/2013/11/stable-channel-update.html
CONFIRM https://code.google.com/p/chromium/issues/detail?id=306959
CONFIRM https://src.chromium.org/viewvc/chrome?revision=229611&view=revision
DEBIAN DSA-2799
SUSE openSUSE-SU-2013:1776
SUSE openSUSE-SU-2013:1777
SUSE openSUSE-SU-2013:1861
SUSE openSUSE-SU-2014:0065
OVAL oval:org.mitre.oval:def:19108