CVE-2015-7575

EPSS 2.88%
Veröffentlicht 09.01.2016 02:59:10
Zuletzt bearbeitet 06.05.2026 22:30:45
Quelle secalert@redhat.com
CVE-Watchlists
Login
Unerledigt
Login

Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 0 Referenzen 55

NVD 19 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Mozilla ≫ Network Security Services Version <= 3.20.1

Opensuse ≫ Leap Version42.1

Opensuse ≫ Opensuse Version13.1

Opensuse ≫ Opensuse Version13.2

Mozilla ≫ Firefox Version38.0

Mozilla ≫ Firefox Version38.0.1

Mozilla ≫ Firefox Version38.0.5

Mozilla ≫ Firefox Version38.1.0

Mozilla ≫ Firefox Version38.1.1

Mozilla ≫ Firefox Version38.2.0

Mozilla ≫ Firefox Version38.2.1

Mozilla ≫ Firefox Version38.3.0

Mozilla ≫ Firefox Version38.4.0

Mozilla ≫ Firefox Version38.5.0

Mozilla ≫ Firefox Version38.5.1

Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts

Canonical ≫ Ubuntu Linux Version15.04

Canonical ≫ Ubuntu Linux Version15.10

Mozilla ≫ Firefox Version <= 43.0.1

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	2.88%	0.85

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	5.9	2.2	3.6	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:P/A:N

Es wurden noch keine Informationen zu CWE veröffentlicht.

http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

Third Party Advisory

http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html

http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html

Vendor Advisory

http://www.securityfocus.com/bid/91787

Third Party Advisory

VDB Entry

https://security.gentoo.org/glsa/201801-15

http://www.debian.org/security/2016/dsa-3688

https://security.gentoo.org/glsa/201701-46

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html

https://access.redhat.com/errata/RHSA-2016:1430

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.html

http://rhn.redhat.com/errata/RHSA-2016-0053.html

http://rhn.redhat.com/errata/RHSA-2016-0054.html

https://security.gentoo.org/glsa/201706-18

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html

http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html

http://rhn.redhat.com/errata/RHSA-2016-0055.html

http://rhn.redhat.com/errata/RHSA-2016-0056.html

http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html

Third Party Advisory

http://lists.opensuse.org/opensuse-updates/2015-12/msg00139.html

http://lists.opensuse.org/opensuse-updates/2016-01/msg00005.html

http://lists.opensuse.org/opensuse-updates/2016-01/msg00058.html

http://lists.opensuse.org/opensuse-updates/2016-01/msg00059.html

http://lists.opensuse.org/opensuse-updates/2016-02/msg00101.html

http://lists.opensuse.org/opensuse-updates/2016-02/msg00166.html

http://rhn.redhat.com/errata/RHSA-2016-0049.html

http://rhn.redhat.com/errata/RHSA-2016-0050.html

http://www.debian.org/security/2016/dsa-3436

http://www.debian.org/security/2016/dsa-3437

http://www.debian.org/security/2016/dsa-3457

http://www.debian.org/security/2016/dsa-3458

http://www.debian.org/security/2016/dsa-3465

http://www.debian.org/security/2016/dsa-3491

http://www.mozilla.org/security/announce/2015/mfsa2015-150.html

Vendor Advisory

http://www.securityfocus.com/bid/79684

http://www.securitytracker.com/id/1034541

http://www.securitytracker.com/id/1036467

http://www.ubuntu.com/usn/USN-2863-1

http://www.ubuntu.com/usn/USN-2864-1

http://www.ubuntu.com/usn/USN-2865-1

http://www.ubuntu.com/usn/USN-2866-1

http://www.ubuntu.com/usn/USN-2884-1

Third Party Advisory

http://www.ubuntu.com/usn/USN-2904-1

https://bugzilla.mozilla.org/show_bug.cgi?id=1158489

Issue Tracking

https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.20.2_release_notes

Vendor Advisory

https://security.netapp.com/advisory/ntap-20160225-0001/

https://nvd.nist.gov/vuln/detail/CVE-2015-7575

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2015-7575

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2015-7575

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2015-7575