CVE-2010-3173

Firefox < 3.5.14 and 3.6.x < 3.6.11 - Weak SSL Key Length in DHE Mode

Title source: llm
STIX 2.1

Description

The SSL implementation in Mozilla Firefox before 3.5.14 and 3.6.x before 3.6.11, Thunderbird before 3.0.9 and 3.1.x before 3.1.5, and SeaMonkey before 2.0.9 does not properly set the minimum key length for Diffie-Hellman Ephemeral (DHE) mode, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via a brute-force attack.

References (18)

Core 18
Core References
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:210
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:211
Vendor Advisory x_refsource_confirm
http://support.avaya.com/css/P8/documents/100114250
Vendor Advisory x_refsource_confirm
http://support.avaya.com/css/P8/documents/100120156
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2010-0782.html
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=554354
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=583337
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=595300
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2010-0781.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/42867
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0061
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12118
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1007-1
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2010/dsa-2123
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/41839
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=587234

Scores

EPSS 0.0304
EPSS Percentile 86.0%

Details

CWE
CWE-310
Status published
Products (47)
mozilla/firefox 3.6
mozilla/firefox 3.6.2
mozilla/firefox 3.6.3
mozilla/firefox 3.6.4
mozilla/firefox 3.6.6
mozilla/firefox 3.6.7
mozilla/firefox 3.6.8
mozilla/firefox 3.6.9
mozilla/firefox 3.6.10
mozilla/firefox 1.0 (2 CPE variants)
... and 37 more
Published Oct 21, 2010
Tracked Since Feb 18, 2026