CVE-2015-7575
Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.
- Affected products
- Alt Linux, Centos, Ibm Aix, Java Platform, Firefox, Firefox Esr, Network Security Services, Oracle Java Se
- Mozilla Network Security Services
- ≤ 3.20.1
- CVSS 3.0
- 5.9 MEDIUM
- EPSS
- 2.9% (85th percentile)
- Weakness
- CWE-19
- NVD status
- Modified
- Published
- 2016-01-09
CVE-2015-7575 at NVD
No indexed exploits for CVE-2015-7575 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2015-7575 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.