CVE-2016-20011

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

libgrss through 0.7.0 fails to perform TLS certificate verification when downloading feeds, allowing remote attackers to manipulate the contents of feeds without detection. This occurs because of the default behavior of SoupSessionSync.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://bugzilla.gnome.org/show_bug.cgi?id=772647Issue Tracking, Vendor Advisory
https://gitlab.gnome.org/GNOME/libgrss/-/issues/4Issue Tracking, Vendor Advisory
https://gitlab.gnome.org/GNOME/libgrss/-/merge_requests/7.patchMailing List, Patch, Vendor Advisory
https://bugzilla.gnome.org/show_bug.cgi?id=772647Issue Tracking, Vendor Advisory
https://gitlab.gnome.org/GNOME/libgrss/-/issues/4Issue Tracking, Vendor Advisory
https://gitlab.gnome.org/GNOME/libgrss/-/merge_requests/7.patchMailing List, Patch, Vendor Advisory

Timeline

Published: May 25, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-200125.3OpenSSH through 8.7 allows remote attackers, who have a suspicion that a certain combination of username and public key is known to an SSH s CVE-2016-200137.5sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is pr CVE-2016-200149.8In pam_tacplus.c in pam_tacplus before 1.4.1, pam_sm_acct_mgmt does not zero out the arep data structure.CVE-2016-200157.5In the ebuild package through smokeping-2.7.3-r1 for SmokePing on Gentoo, the initscript allows the smokeping user to gain ownership of any CVE-2016-200169.8MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI. A remote CVE-2016-200179.8D-Link DSL-2750B devices before 1.05 allow remote unauthenticated command injection via the login.cgi cli parameter, as exploited in the wil CVE-2016-200187.5Knex Knex.js through 2.3.0 has a limited SQL injection vulnerability that can be exploited to ignore the WHERE clause of a SQL query.CVE-2016-20029.8The validateAdminConfig handler in the Analytics Management Console in HPE Vertica 7.0.x before 7.0.2.12, 7.1.x before 7.1.2-12, and 7.2.x b CVE-2016-200219.8In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file b CVE-2016-200228.4In the Linux kernel before 4.8, usb_parse_endpoint in drivers/usb/core/config.c does not validate the wMaxPacketSize field of an endpoint de CVE-2016-200236.5In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file w CVE-2016-200249.8ZKTeco ZKTime.Net 3.0.1.6 contains an insecure file permissions vulnerability that allows unprivileged users to escalate privileges by modif