CVE-2015-7575

MEDIUM

Mozilla NSS <3.20.2 - Info Disclosure

Title source: llm

Description

Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.

References (52)

Core 52

Core References

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2016/dsa-3688

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2016/dsa-3457

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2016/dsa-3491

Third Party Advisory vendor-advisory x_refsource_gentoo

https://security.gentoo.org/glsa/201701-46

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2016/dsa-3465

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2016-0049.html

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2016/dsa-3437

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2016-0053.html

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-2904-1

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2015-12/msg00139.html

Vendor Advisory x_refsource_confirm

https://security.netapp.com/advisory/ntap-20160225-0001/

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2016/dsa-3436

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-2866-1

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html

Third Party Advisory x_refsource_confirm

http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/91787

Vendor Advisory x_refsource_confirm

http://www.mozilla.org/security/announce/2015/mfsa2015-150.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2016-0055.html

Third Party Advisory vendor-advisory x_refsource_gentoo

https://security.gentoo.org/glsa/201801-15

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2016-0054.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2016-02/msg00101.html

Third Party Advisory vendor-advisory x_refsource_gentoo

https://security.gentoo.org/glsa/201706-18

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-2864-1

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2016-01/msg00059.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2016-02/msg00166.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2016-0056.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html

Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html

Vendor Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2016-0050.html

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2016/dsa-3458

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-2865-1

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1034541

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2016-01/msg00005.html

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-2863-1

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.html

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1036467

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2016-01/msg00058.html

Third Party Advisory x_refsource_confirm

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Third Party Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-2884-1

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/79684

Vendor Advisory x_refsource_confirm

https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.20.2_release_notes

Vendor Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

Vendor Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2016:1430

Issue Tracking x_refsource_confirm

https://bugzilla.mozilla.org/show_bug.cgi?id=1158489

Vendor Advisory x_refsource_confirm

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html

Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html

Scores

CVSS v3 5.9

EPSS 0.0107

EPSS Percentile 78.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-19

Status published

Products (19)

canonical/ubuntu_linux 14.04

canonical/ubuntu_linux 15.04

canonical/ubuntu_linux 15.10

mozilla/firefox 38.0

mozilla/firefox 38.0.1

mozilla/firefox 38.0.5

mozilla/firefox 38.1.0

mozilla/firefox 38.1.1

mozilla/firefox 38.2.0

mozilla/firefox 38.2.1

... and 9 more

Published Jan 09, 2016

Tracked Since Feb 18, 2026