CVE-2015-7575
CVE-2015-7575
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This page shows selected source facts. See the linked advisories for the complete description and affected versions.
Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.
CVSS 5.9 · Medium · EPSS 2.9% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
gnutls28 Debian:12
- Affected ranges
- ECOSYSTEM: < 3.3.15-1
Update to 3.3.15-1
gnutls28 Debian:13
- Affected ranges
- ECOSYSTEM: < 3.3.15-1
Update to 3.3.15-1
gnutls28 Debian:14
- Affected ranges
- ECOSYSTEM: < 3.3.15-1
Update to 3.3.15-1
nss Debian:12
- Affected ranges
- ECOSYSTEM: < 2:3.21-1
Update to 2:3.21-1
nss Debian:13
- Affected ranges
- ECOSYSTEM: < 2:3.21-1
Update to 2:3.21-1
nss Debian:14
- Affected ranges
- ECOSYSTEM: < 2:3.21-1
Update to 2:3.21-1
openssl Debian:12
- Affected ranges
- ECOSYSTEM: < 1.0.1f-1
Update to 1.0.1f-1
openssl Debian:13
- Affected ranges
- ECOSYSTEM: < 1.0.1f-1
Update to 1.0.1f-1
openssl Debian:14
- Affected ranges
- ECOSYSTEM: < 1.0.1f-1
Update to 1.0.1f-1
firefox Ubuntu:14.04:LTS
- Versions
- 24.0+build1-0ubuntu1
- 25.0+build3-0ubuntu0.13.10.1
- 28.0~b2+build1-0ubuntu2
- 28.0+build1-0ubuntu1
- 28.0+build2-0ubuntu1
- 28.0+build2-0ubuntu2
- 29.0+build1-0ubuntu0.14.04.2
- 30.0+build1-0ubuntu0.14.04.3
- 31.0+build1-0ubuntu0.14.04.1
- 32.0+build1-0ubuntu0.14.04.1
- 32.0.3+build1-0ubuntu0.14.04.1
- 33.0+build2-0ubuntu0.14.04.1
- 34.0+build2-0ubuntu0.14.04.1
- 35.0+build3-0ubuntu0.14.04.2
- 35.0.1+build1-0ubuntu0.14.04.1
- 36.0+build2-0ubuntu0.14.04.4
- 36.0.1+build2-0ubuntu0.14.04.1
- 36.0.4+build1-0ubuntu0.14.04.1
- 37.0+build2-0ubuntu0.14.04.1
- 37.0.1+build1-0ubuntu0.14.04.1
- 37.0.2+build1-0ubuntu0.14.04.1
- 38.0+build3-0ubuntu0.14.04.1
- 39.0+build5-0ubuntu0.14.04.1
- 39.0.3+build2-0ubuntu0.14.04.1
- 40.0+build4-0ubuntu0.14.04.1
- 40.0+build4-0ubuntu0.14.04.4
- 40.0.3+build1-0ubuntu0.14.04.1
- 41.0+build3-0ubuntu0.14.04.1
- 41.0.1+build2-0ubuntu0.14.04.1
- 41.0.2+build2-0ubuntu0.14.04.1
- 42.0+build2-0ubuntu0.14.04.1
- 43.0+build1-0ubuntu0.14.04.1
- Affected ranges
- ECOSYSTEM: < 43.0.4+build3-0ubuntu0.14.04.1
Update to 43.0.4+build3-0ubuntu0.14.04.1
gnutls26 Ubuntu:14.04:LTS
- Versions
- 2.12.23-1ubuntu4
- 2.12.23-1ubuntu5
- 2.12.23-12ubuntu1
- 2.12.23-12ubuntu2
- 2.12.23-12ubuntu2.1
- 2.12.23-12ubuntu2.2
- 2.12.23-12ubuntu2.3
- Affected ranges
- ECOSYSTEM: < 2.12.23-12ubuntu2.4
Update to 2.12.23-12ubuntu2.4
nss Ubuntu:14.04:LTS
- Versions
- 2:3.15.1-1ubuntu1
- 2:3.15.2-1
- 2:3.15.3-1
- 2:3.15.3.1-1
- 2:3.15.3.1-1.1
- 2:3.15.3.1-1.1ubuntu1
- 2:3.15.4-1ubuntu3
- 2:3.15.4-1ubuntu4
- 2:3.15.4-1ubuntu5
- 2:3.15.4-1ubuntu6
- 2:3.15.4-1ubuntu7
- 2:3.15.4-1ubuntu7.1
- 2:3.17-0ubuntu0.14.04.1
- 2:3.17.1-0ubuntu0.14.04.1
- 2:3.17.1-0ubuntu0.14.04.2
- 2:3.17.4-0ubuntu0.14.04.1
- 2:3.19.2-0ubuntu0.14.04.1
- 2:3.19.2.1-0ubuntu0.14.04.1
- Affected ranges
- ECOSYSTEM: < 2:3.19.2.1-0ubuntu0.14.04.2
Update to 2:3.19.2.1-0ubuntu0.14.04.2
openjdk-6 Ubuntu:14.04:LTS
- Versions
- 6b27-1.12.6-1ubuntu2
- 6b27-1.12.7-2ubuntu1
- 6b29-1.13.0-1ubuntu2
- 6b30-1.13.1-1ubuntu1
- 6b30-1.13.1-1ubuntu2
- 6b30-1.13.2-1ubuntu1
- 6b31-1.13.3-1ubuntu1
- 6b32-1.13.4-4ubuntu0.14.04.1
- 6b33-1.13.5-1ubuntu0.14.04
- 6b34-1.13.6-1ubuntu0.14.04.1
- 6b35-1.13.7-1ubuntu0.14.04.1
- 6b36-1.13.8-0ubuntu1~14.04
- 6b37-1.13.9-1ubuntu0.14.04.1
- Affected ranges
- ECOSYSTEM: < 6b38-1.13.10-0ubuntu0.14.04.1
Update to 6b38-1.13.10-0ubuntu0.14.04.1
openjdk-7 Ubuntu:14.04:LTS
- Versions
- 7u25-2.3.12-4ubuntu3
- 7u25-2.3.12-4ubuntu5
- 7u45-2.4.3-3ubuntu1
- 7u45-2.4.3-3ubuntu2
- 7u45-2.4.3-4ubuntu1
- 7u45-2.4.3-4ubuntu2
- 7u51-2.4.4-1ubuntu1
- 7u51-2.4.5-1ubuntu1
- 7u51-2.4.6~pre1-1ubuntu2
- 7u51-2.4.6-1ubuntu3
- 7u51-2.4.6-1ubuntu4
- 7u55-2.4.7-1ubuntu1
- 7u65-2.5.1-4ubuntu1~0.14.04.1
- 7u65-2.5.1-4ubuntu1~0.14.04.2
- 7u65-2.5.2-3~14.04
- 7u71-2.5.3-0ubuntu0.14.04.1
- 7u75-2.5.4-1~trusty1
- 7u79-2.5.5-0ubuntu0.14.04.2
- 7u79-2.5.6-0ubuntu1.14.04.1
- 7u85-2.6.1-5ubuntu0.14.04.1
- 7u91-2.6.3-0ubuntu0.14.04.1
- Affected ranges
- ECOSYSTEM: < 7u95-2.6.4-0ubuntu0.14.04.1
Update to 7u95-2.6.4-0ubuntu0.14.04.1
thunderbird Ubuntu:14.04:LTS
- Versions
- 1:24.0+build1-0ubuntu1
- 1:24.0+build1-0ubuntu2
- 1:24.1.1+build1-0ubuntu0.13.10.1
- 1:24.1.1+build1-0ubuntu1
- 1:24.2.0+build1-0ubuntu1
- 1:24.4.0+build1-0ubuntu1
- 1:24.5.0+build1-0ubuntu0.14.04.1
- 1:24.6.0+build1-0ubuntu0.14.04.1
- 1:31.0+build1-0ubuntu0.14.04.1
- 1:31.1.1+build1-0ubuntu0.14.04.1
- 1:31.1.2+build1-0ubuntu0.14.04.1
- 1:31.2.0+build2-0ubuntu0.14.04.1
- 1:31.3.0+build1-0ubuntu0.14.04.1
- 1:31.4.0+build1-0ubuntu0.14.04.1
- 1:31.5.0+build1-0ubuntu0.14.04.1
- 1:31.6.0+build1-0ubuntu0.14.04.1
- 1:31.7.0+build1-0ubuntu0.14.04.1
- 1:31.8.0+build1-0ubuntu0.14.04.1
- 1:38.2.0+build1-0ubuntu0.14.04.1
- 1:38.3.0+build1-0ubuntu0.14.04.1
- 1:38.4.0+build3-0ubuntu0.14.04.1
- 1:38.5.1+build2-0ubuntu0.14.04.1
- Affected ranges
- ECOSYSTEM: < 1:38.6.0+build1-0ubuntu0.14.04.1
Update to 1:38.6.0+build1-0ubuntu0.14.04.1
thunderbird Ubuntu:16.04:LTS
- Versions
- 1:38.3.0+build1-0ubuntu2
- 1:38.5.1+build2-0ubuntu1
- Affected ranges
- ECOSYSTEM: < 1:38.6.0+build1-0ubuntu1
Update to 1:38.6.0+build1-0ubuntu1
Original sources
- http://www.debian.org/security/2016/dsa-3688
- http://www.debian.org/security/2016/dsa-3457
- http://www.debian.org/security/2016/dsa-3491
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.html
- http://www.securitytracker.com/id/1036467
- https://security.gentoo.org/glsa/201701-46
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.html
- http://lists.opensuse.org/opensuse-updates/2016-01/msg00058.html
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html
- http://www.ubuntu.com/usn/USN-2884-1
- http://www.securityfocus.com/bid/79684
- http://www.debian.org/security/2016/dsa-3465
- https://developer.mozilla.org/docs/Mozilla/Projects/NSS/NSS_3.20.2_release_notes
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html
- https://access.redhat.com/errata/RHSA-2016:1430
- https://bugzilla.mozilla.org/show_bug.cgi?id=1158489
- http://rhn.redhat.com/errata/RHSA-2016-0049.html
- http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.html
- http://www.debian.org/security/2016/dsa-3437
- http://rhn.redhat.com/errata/RHSA-2016-0053.html
- https://nvd.nist.gov/vuln/detail/CVE-2015-7575