libgdata before 0.10.2 and 0.11.x before 0.11.1 does not validate...

Vulnerability Description

libgdata before 0.10.2 and 0.11.x before 0.11.1 does not validate SSL certificates, which allows remote attackers to obtain user names and passwords via a man-in-the-middle (MITM) attack with a spoofed certificate.

References

• http://git.gnome.org/browse/libgdata/commit/?h=libgdata-0-10&id=8eff8fa9138859e03e58c2aa76600ab63eb5c29c
• https://bugzilla.novell.com/show_bug.cgi?id=752088
• http://www.openwall.com/lists/oss-security/2012/03/14/8
• http://www.openwall.com/lists/oss-security/2012/03/14/1
• http://www.debian.org/security/2012/dsa-2482
• http://www.mandriva.com/security/advisories?name=MDVSA-2012:111
• https://bugs.launchpad.net/ubuntu/+source/libgdata/+bug/938812
• https://bugzilla.gnome.org/show_bug.cgi?id=671535
• http://git.gnome.org/browse/libgdata/commit/?id=6799f2c525a584dc998821a6ce897e463dad7840
• http://www.openwall.com/lists/oss-security/2012/03/14/3
• http://secunia.com/advisories/50432
• http://www.ubuntu.com/usn/USN-1547-1