NetSight
IP …
medium5.9

CVE-2015-7575

Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatu…

Impact

Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.

Affected products

VendorProductAffected versions
MozillaNetwork Security Services
through 3.20.1
OpensuseLeap
Version 42.1
OpensuseOpensuse
Versions 13.1, 13.2
MozillaFirefox
Versions 38.0, 38.0.1, 38.0.5, 38.1.0, 38.1.1, 38.2.0
CanonicalUbuntu Linux
Versions 14.04, 15.04, 15.10

Weakness classification

CWE-19

References