CVE-2015-7575

N/A

Description

Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.

CVE Details

CVSS v3.1 ScoreN/A

Published1/9/2016

Last Modified4/12/2025

Sourcenvd

Honeypot Sightings0

Affected Products

canonical:ubuntu_linuxmozilla:firefoxmozilla:network_security_servicesopensuse:leapopensuse:opensuse

Weaknesses (CWE)

CWE-19

References

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-updates/2015-12/msg00139.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-updates/2016-01/msg00005.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-updates/2016-01/msg00058.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-updates/2016-01/msg00059.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-updates/2016-02/msg00101.html(secalert@redhat.com)

http://lists.opensuse.org/opensuse-updates/2016-02/msg00166.html(secalert@redhat.com)

http://rhn.redhat.com/errata/RHSA-2016-0049.html(secalert@redhat.com)

http://rhn.redhat.com/errata/RHSA-2016-0050.html(secalert@redhat.com)

http://rhn.redhat.com/errata/RHSA-2016-0053.html(secalert@redhat.com)

http://rhn.redhat.com/errata/RHSA-2016-0054.html(secalert@redhat.com)

http://rhn.redhat.com/errata/RHSA-2016-0055.html(secalert@redhat.com)

http://rhn.redhat.com/errata/RHSA-2016-0056.html(secalert@redhat.com)

http://www.debian.org/security/2016/dsa-3436(secalert@redhat.com)

http://www.debian.org/security/2016/dsa-3437(secalert@redhat.com)

http://www.debian.org/security/2016/dsa-3457(secalert@redhat.com)

http://www.debian.org/security/2016/dsa-3458(secalert@redhat.com)

http://www.debian.org/security/2016/dsa-3465(secalert@redhat.com)

http://www.debian.org/security/2016/dsa-3491(secalert@redhat.com)

http://www.debian.org/security/2016/dsa-3688(secalert@redhat.com)

http://www.mozilla.org/security/announce/2015/mfsa2015-150.html(secalert@redhat.com)

http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html(secalert@redhat.com)

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html(secalert@redhat.com)

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html(secalert@redhat.com)

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html(secalert@redhat.com)

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html(secalert@redhat.com)

http://www.securityfocus.com/bid/79684(secalert@redhat.com)

http://www.securityfocus.com/bid/91787(secalert@redhat.com)

http://www.securitytracker.com/id/1034541(secalert@redhat.com)

http://www.securitytracker.com/id/1036467(secalert@redhat.com)

http://www.ubuntu.com/usn/USN-2863-1(secalert@redhat.com)

http://www.ubuntu.com/usn/USN-2864-1(secalert@redhat.com)

http://www.ubuntu.com/usn/USN-2865-1(secalert@redhat.com)

http://www.ubuntu.com/usn/USN-2866-1(secalert@redhat.com)

http://www.ubuntu.com/usn/USN-2884-1(secalert@redhat.com)

http://www.ubuntu.com/usn/USN-2904-1(secalert@redhat.com)

https://access.redhat.com/errata/RHSA-2016:1430(secalert@redhat.com)

https://bugzilla.mozilla.org/show_bug.cgi?id=1158489(secalert@redhat.com)

https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.20.2_release_notes(secalert@redhat.com)

https://security.gentoo.org/glsa/201701-46(secalert@redhat.com)

https://security.gentoo.org/glsa/201706-18(secalert@redhat.com)

https://security.gentoo.org/glsa/201801-15(secalert@redhat.com)

https://security.netapp.com/advisory/ntap-20160225-0001/(secalert@redhat.com)

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-updates/2015-12/msg00139.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-updates/2016-01/msg00005.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-updates/2016-01/msg00058.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-updates/2016-01/msg00059.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-updates/2016-02/msg00101.html(af854a3a-2127-422b-91ae-364da2661108)

http://lists.opensuse.org/opensuse-updates/2016-02/msg00166.html(af854a3a-2127-422b-91ae-364da2661108)

http://rhn.redhat.com/errata/RHSA-2016-0049.html(af854a3a-2127-422b-91ae-364da2661108)

http://rhn.redhat.com/errata/RHSA-2016-0050.html(af854a3a-2127-422b-91ae-364da2661108)

http://rhn.redhat.com/errata/RHSA-2016-0053.html(af854a3a-2127-422b-91ae-364da2661108)

http://rhn.redhat.com/errata/RHSA-2016-0054.html(af854a3a-2127-422b-91ae-364da2661108)

http://rhn.redhat.com/errata/RHSA-2016-0055.html(af854a3a-2127-422b-91ae-364da2661108)

http://rhn.redhat.com/errata/RHSA-2016-0056.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.debian.org/security/2016/dsa-3436(af854a3a-2127-422b-91ae-364da2661108)

http://www.debian.org/security/2016/dsa-3437(af854a3a-2127-422b-91ae-364da2661108)

http://www.debian.org/security/2016/dsa-3457(af854a3a-2127-422b-91ae-364da2661108)

http://www.debian.org/security/2016/dsa-3458(af854a3a-2127-422b-91ae-364da2661108)

http://www.debian.org/security/2016/dsa-3465(af854a3a-2127-422b-91ae-364da2661108)

http://www.debian.org/security/2016/dsa-3491(af854a3a-2127-422b-91ae-364da2661108)

http://www.debian.org/security/2016/dsa-3688(af854a3a-2127-422b-91ae-364da2661108)

http://www.mozilla.org/security/announce/2015/mfsa2015-150.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/bid/79684(af854a3a-2127-422b-91ae-364da2661108)

http://www.securityfocus.com/bid/91787(af854a3a-2127-422b-91ae-364da2661108)

http://www.securitytracker.com/id/1034541(af854a3a-2127-422b-91ae-364da2661108)

http://www.securitytracker.com/id/1036467(af854a3a-2127-422b-91ae-364da2661108)

http://www.ubuntu.com/usn/USN-2863-1(af854a3a-2127-422b-91ae-364da2661108)

http://www.ubuntu.com/usn/USN-2864-1(af854a3a-2127-422b-91ae-364da2661108)

http://www.ubuntu.com/usn/USN-2865-1(af854a3a-2127-422b-91ae-364da2661108)

http://www.ubuntu.com/usn/USN-2866-1(af854a3a-2127-422b-91ae-364da2661108)

http://www.ubuntu.com/usn/USN-2884-1(af854a3a-2127-422b-91ae-364da2661108)

http://www.ubuntu.com/usn/USN-2904-1(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2016:1430(af854a3a-2127-422b-91ae-364da2661108)

https://bugzilla.mozilla.org/show_bug.cgi?id=1158489(af854a3a-2127-422b-91ae-364da2661108)

https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.20.2_release_notes(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/201701-46(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/201706-18(af854a3a-2127-422b-91ae-364da2661108)

https://security.gentoo.org/glsa/201801-15(af854a3a-2127-422b-91ae-364da2661108)

https://security.netapp.com/advisory/ntap-20160225-0001/(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.