Vulnerability Details : CVE-2015-7575
Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.
Products affected by CVE-2015-7575
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:38.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:network_security_services:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
- cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2015-7575
2.01%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 82 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2015-7575
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:N/I:P/A:N |
8.6
|
2.9
|
NIST | |
|
5.9
|
MEDIUM | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |
2.2
|
3.6
|
NIST |
CWE ids for CVE-2015-7575
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-7575
-
http://www.ubuntu.com/usn/USN-2863-1
USN-2863-1: OpenSSL vulnerability | Ubuntu security notices
-
http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
Oracle Critical Patch Update - January 2016Vendor Advisory
-
https://security.netapp.com/advisory/ntap-20160225-0001/
CVE-2015-7575 TLS Vulnerability in Multiple NetApp Products | NetApp Product Security
-
http://www.securitytracker.com/id/1036467
IBM AIX Default TLS Version Lets Remote Users Conduct Man-in-the-Middle Attacks Obtain Potentially Sensitive Information on the Target System - SecurityTracker
-
http://lists.opensuse.org/opensuse-updates/2016-02/msg00166.html
openSUSE-SU-2016:0605-1: moderate: Security update for bouncycastle
-
http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.html
openSUSE-SU-2016:0307-1: moderate: Security update for seamonkeyThird Party Advisory
-
http://www.ubuntu.com/usn/USN-2865-1
USN-2865-1: GnuTLS vulnerability | Ubuntu security notices
-
http://lists.opensuse.org/opensuse-updates/2015-12/msg00139.html
openSUSE-SU-2015:2405-1: moderate: Security update for mozilla-nss
-
http://lists.opensuse.org/opensuse-updates/2016-01/msg00059.html
openSUSE-SU-2016:0162-1: moderate: Security update for mbedtls
-
http://www.securitytracker.com/id/1034541
Mozilla Firefox MD5 Signature Support in TLS ServerKeyExchange Messages Exposes Users to Hash Collision Forgery Attacks - SecurityTracker
-
http://www.debian.org/security/2016/dsa-3458
Debian -- Security Information -- DSA-3458-1 openjdk-7
-
http://www.ubuntu.com/usn/USN-2866-1
USN-2866-1: Firefox vulnerability | Ubuntu security notices
-
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html
[security-announce] SUSE-SU-2016:0269-1: critical: Security update for j
-
http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html
openSUSE-SU-2016:0308-1: moderate: Security update for SeamonkeyThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html
[security-announce] SUSE-SU-2016:0265-1: critical: Security update for j
-
http://www.securityfocus.com/bid/79684
Mozilla Network Security Services CVE-2015-7575 Security Bypass Vulnerability
-
http://lists.opensuse.org/opensuse-updates/2016-01/msg00005.html
openSUSE-SU-2016:0007-1: moderate: Security update for MozillaFirefox
-
http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html
cpuapr2016v3Third Party Advisory
-
http://www.securityfocus.com/bid/91787
Oracle July 2016 Critical Patch Update Multiple VulnerabilitiesThird Party Advisory;VDB Entry
-
http://www.debian.org/security/2016/dsa-3436
Debian -- Security Information -- DSA-3436-1 openssl
-
http://lists.opensuse.org/opensuse-updates/2016-01/msg00058.html
openSUSE-SU-2016:0161-1: moderate: Security update for polarssl
-
https://security.gentoo.org/glsa/201801-15
PolarSSL: Multiple vulnerabilities (GLSA 201801-15) — Gentoo security
-
https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.20.2_release_notes
NSS 3.20.2 release notes - Mozilla | MDNVendor Advisory
-
https://security.gentoo.org/glsa/201706-18
mbed TLS: Multiple vulnerabilities (GLSA 201706-18) — Gentoo security
-
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html
[security-announce] SUSE-SU-2016:0256-1: critical: Security update for j
-
http://rhn.redhat.com/errata/RHSA-2016-0056.html
RHSA-2016:0056 - Security Advisory - Red Hat Customer Portal
-
http://www.debian.org/security/2016/dsa-3491
Debian -- Security Information -- DSA-3491-1 icedove
-
http://rhn.redhat.com/errata/RHSA-2016-0049.html
RHSA-2016:0049 - Security Advisory - Red Hat Customer Portal
-
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
Oracle Critical Patch Update - October 2017
-
http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
Oracle Critical Patch Update - July 2016Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.html
[security-announce] openSUSE-SU-2016:0279-1: critical: Security update f
-
http://rhn.redhat.com/errata/RHSA-2016-0050.html
RHSA-2016:0050 - Security Advisory - Red Hat Customer Portal
-
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
Oracle Linux Bulletin - January 2016
-
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html
[security-announce] openSUSE-SU-2016:0268-1: critical: Security update f
-
http://rhn.redhat.com/errata/RHSA-2016-0054.html
RHSA-2016:0054 - Security Advisory - Red Hat Customer Portal
-
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html
[security-announce] openSUSE-SU-2016:0270-1: critical: Security update f
-
http://www.ubuntu.com/usn/USN-2884-1
USN-2884-1: OpenJDK 7 vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://lists.opensuse.org/opensuse-updates/2016-02/msg00101.html
openSUSE-SU-2016:0488-1: moderate: Security update for Thunderbird
-
http://www.mozilla.org/security/announce/2015/mfsa2015-150.html
MD5 signatures accepted within TLS 1.2 ServerKeyExchange in server signature — MozillaVendor Advisory
-
http://www.debian.org/security/2016/dsa-3437
Debian -- Security Information -- DSA-3437-1 gnutls26
-
https://access.redhat.com/errata/RHSA-2016:1430
RHSA-2016:1430 - Security Advisory - Red Hat Customer Portal
-
http://www.ubuntu.com/usn/USN-2864-1
USN-2864-1: NSS vulnerability | Ubuntu security notices
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1158489
1158489 - (CVE-2015-7575) Prevent MD5 Downgrade in TLS 1.2 SignaturesIssue Tracking
-
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.html
[security-announce] openSUSE-SU-2016:0272-1: important: Security update
-
http://rhn.redhat.com/errata/RHSA-2016-0055.html
RHSA-2016:0055 - Security Advisory - Red Hat Customer Portal
-
http://www.ubuntu.com/usn/USN-2904-1
USN-2904-1: Thunderbird vulnerabilities | Ubuntu security notices
-
http://www.debian.org/security/2016/dsa-3688
Debian -- Security Information -- DSA-3688-1 nss
-
http://rhn.redhat.com/errata/RHSA-2016-0053.html
RHSA-2016:0053 - Security Advisory - Red Hat Customer Portal
-
https://security.gentoo.org/glsa/201701-46
Mozilla Network Security Service (NSS): Multiple vulnerabilities (GLSA 201701-46) — Gentoo security
-
http://www.debian.org/security/2016/dsa-3457
Debian -- Security Information -- DSA-3457-1 iceweasel
-
http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html
[security-announce] openSUSE-SU-2016:0263-1: critical: Security update f
-
http://www.debian.org/security/2016/dsa-3465
Debian -- Security Information -- DSA-3465-1 openjdk-6
Jump to