Vulnerability Description
Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Network Security Services | <= 3.20.1 |
| Opensuse | Leap | 42.1 |
| Opensuse | Opensuse | 13.1 |
| Mozilla | Firefox | 38.0 |
| Canonical | Ubuntu Linux | 14.04 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00038.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00041.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00042.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00043.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00044.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00045.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00047.html
- http://lists.opensuse.org/opensuse-security-announce/2016-01/msg00048.html
- http://lists.opensuse.org/opensuse-updates/2015-12/msg00139.html
- http://lists.opensuse.org/opensuse-updates/2016-01/msg00005.html
- http://lists.opensuse.org/opensuse-updates/2016-01/msg00058.html
- http://lists.opensuse.org/opensuse-updates/2016-01/msg00059.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00007.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00008.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00101.html
FAQ
What is CVE-2015-7575?
CVE-2015-7575 is a vulnerability with a CVSS score of 5.9 (MEDIUM). Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TL...
How severe is CVE-2015-7575?
CVE-2015-7575 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-7575?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Network Security Services, Opensuse Leap, Opensuse Opensuse, Mozilla Firefox, Canonical Ubuntu Linux.