CVE-2010-3900: Midori before 0.2.5, when WebKitGTK+ before 1.1.14 or LibSoup before 2.29.91 is used, does not verify X.509...

Security readout for executives and security teams

Midori could accept fake HTTPS certificates in affected builds, removing a core browser trust check. A network attacker positioned between the user and a website could impersonate secure sites and capture or alter sensitive traffic. This mainly matters where legacy Linux desktop/browser packages are still used. Exposure is likely limited to legacy systems running old Midori builds and affected WebKitGTK+ or LibSoup libraries. Current enterprise exposure should be validated through asset inventory, especially on unsupported Linux desktops, kiosks, embedded builds, or archived images. Treat as a focused legacy-risk cleanup, not a broad emergency. Prioritize systems that still browse sensitive sites or operate on untrusted networks. If no affected Midori deployments exist, document non-exposure and close. Mitigation focus: Upgrade Midori to 0.2.5 or later where it remains deployed.; Verify WebKitGTK+ is 1.1.14 or later and LibSoup is 2.29.91 or later.; Apply relevant distribution vendor updates, including SUSE guidance where applicable..

Prepared

Jun 28, 2026, 01:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.