CVE-2009-2700

Name	CVE-2009-2700
Description	src/network/ssl/qsslcertificate.cpp in Nokia Trolltech Qt 4.x does not properly handle a '\0' character in a domain name in the Subject Alternative Name field of an X.509 certificate, which allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-1988-1
Debian Bugs	545793

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
qt4-x11 (PTS)	jessie, jessie (lts)	4:4.8.6+git64-g5dc8b2b+dfsg-3+deb8u5	fixed
	stretch (security)	4:4.8.7+dfsg-11+deb9u3	fixed
	stretch (lts), stretch	4:4.8.7+dfsg-11+deb9u4	fixed
	buster (security), buster, buster (lts)	4:4.8.7+dfsg-18+deb10u2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
qt4-x11	source	etch	(not affected)
qt4-x11	source	lenny	4.4.3-1+lenny1		DSA-1988-1
qt4-x11	source	(unstable)	4:4.5.3-1	medium		545793

[etch] - qt4-x11 <not-affected> (QSsl* classes were introduced in Qt 4.3)