CVE-2010-4832

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-05-14 · updated 2026-06-16
Weakness: CWE-310

Description

Android OS before 2.2 does not display the correct SSL certificate in certain cases, which might allow remote attackers to spoof trusted web sites via a web page containing references to external sources in which (1) the certificate of the last loaded resource is checked, instead of for the main page, or (2) later certificates are not checked when the HTTPS connection is reused.

Affected products

Android: through 2.1; 1.0, 1.1, 1.5, 1.6, 2.0, 2.0.1

References

http://android.git.kernel.org/?p=platform/frameworks/base.git%3Ba=commit%3Bh=dba8cb76371960457e91b31fa396478f809a5a34
http://jvn.jp/en/jp/JVN43105011/index.html
http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000053.html
https://gitorious.org/atrix-aosp/frameworks_base/commit/dba8cb76371960457e91b31fa396478f809a5a34
http://android.git.kernel.org/?p=platform/frameworks/base.git%3Ba=commit%3Bh=dba8cb76371960457e91b31fa396478f809a5a34
http://jvn.jp/en/jp/JVN43105011/index.html
http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-000053.html
https://gitorious.org/atrix-aosp/frameworks_base/commit/dba8cb76371960457e91b31fa396478f809a5a34

Get alerted when CVE-2010-4832 or the next vulnerability affects your stack