CVE-2015-7575

Published: Jan 9, 2016Modified: May 6, 2026

5.9

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.

Affected (19)

Products: Mozilla: Network Security Services, Firefox · Opensuse: Leap, Opensuse · Canonical: Ubuntu Linux

Mozilla

2 products

Network Security Services

2 products

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mozilla Network Security Services	Up to 3.20.1

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 42.1
Opensuse Opensuse	Version 13.1
Opensuse Opensuse	Version 13.2

Configuration C

11 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Version 38.0.1
Mozilla Firefox	Version 38.0.5
Mozilla Firefox	Version 38.0
Mozilla Firefox	Version 38.1.0
Mozilla Firefox	Version 38.1.1
Mozilla Firefox	Version 38.2.0
Mozilla Firefox	Version 38.2.1
Mozilla Firefox	Version 38.3.0
Mozilla Firefox	Version 38.4.0
Mozilla Firefox	Version 38.5.0
Mozilla Firefox	Version 38.5.1

Configuration D

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 15.04
Canonical Ubuntu Linux	Version 15.10

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Mozilla Firefox	Up to 43.0.1

Related CWEs

CWE-19

References (104)

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2015-12/msg00139.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2016-01/msg00005.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2016-01/msg00058.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2016-01/msg00059.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2016-02/msg00101.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2016-02/msg00166.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0049.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0050.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0053.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0054.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0055.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-0056.html

Source: secalert@redhat.com

http://www.debian.org/security/2016/dsa-3436

Source: secalert@redhat.com

http://www.debian.org/security/2016/dsa-3437

Source: secalert@redhat.com

http://www.debian.org/security/2016/dsa-3457

Source: secalert@redhat.com

http://www.debian.org/security/2016/dsa-3458

Source: secalert@redhat.com

http://www.debian.org/security/2016/dsa-3465

Source: secalert@redhat.com

http://www.debian.org/security/2016/dsa-3491

Source: secalert@redhat.com

http://www.debian.org/security/2016/dsa-3688

Source: secalert@redhat.com

http://www.mozilla.org/security/announce/2015/mfsa2015-150.html

Source: secalert@redhat.com

Vendor Advisory

http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Source: secalert@redhat.com

Vendor Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

Source: secalert@redhat.com

http://www.securityfocus.com/bid/79684

Source: secalert@redhat.com

http://www.securityfocus.com/bid/91787

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1034541

Source: secalert@redhat.com

http://www.securitytracker.com/id/1036467

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2863-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2864-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2865-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2866-1

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-2884-1

Source: secalert@redhat.com

Third Party Advisory

http://www.ubuntu.com/usn/USN-2904-1

Source: secalert@redhat.com

https://access.redhat.com/errata/RHSA-2016:1430

Source: secalert@redhat.com

https://bugzilla.mozilla.org/show_bug.cgi?id=1158489

Source: secalert@redhat.com

Issue Tracking

https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.20.2_release_notes

Source: secalert@redhat.com

Vendor Advisory

https://security.gentoo.org/glsa/201701-46

Source: secalert@redhat.com

https://security.gentoo.org/glsa/201706-18

Source: secalert@redhat.com

https://security.gentoo.org/glsa/201801-15

Source: secalert@redhat.com

https://security.netapp.com/advisory/ntap-20160225-0001/

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html