Published: 06/07/2015 Updated: 12/09/2023

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Mozilla Network Security Services (NSS) prior to 3.19, as used in Mozilla Firefox prior to 39.0, Firefox ESR 31.x prior to 31.8 and 38.x prior to 38.1, Thunderbird prior to 38.1, and other products, does not properly determine state transitions for the TLS state machine, which allows man-in-the-middle malicious users to defeat cryptographic protection mechanisms by blocking messages, as demonstrated by removing a forward-secrecy property by blocking a ServerKeyExchange message, aka a "SMACK SKIP-TLS" issue.

Vulnerable Product	Search on Vulmon	Subscribe to Product
canonical ubuntu linux 12.04
novell suse linux enterprise server 12.0
novell suse linux enterprise server 11
debian debian linux 8.0
debian debian linux 7.0
canonical ubuntu linux 14.10
canonical ubuntu linux 14.04
novell suse linux enterprise desktop 12.0
canonical ubuntu linux 15.04
novell suse linux enterprise software development kit 12.0
mozilla network_security_services 3.19
oracle solaris 11.3
oracle vm server 3.2

Several vulnerabilities have been discovered in nss, the Mozilla Network Security Service library The Common Vulnerabilities and Exposures project identifies the following problems: CVE-2015-2721 Karthikeyan Bhargavan discovered that NSS incorrectly handles state transitions for the TLS state machine A man-in-the-middle attacker coul ...

Several security issues were fixed in NSS ...

Firefox could be made to crash or run programs as your login if it opened a malicious website ...

Several security issues were fixed in Thunderbird ...

Mozilla Foundation Security Advisory 2015-71 NSS incorrectly permits skipping of ServerKeyExchange Announced July 2, 2015 Reporter Karthikeyan Bhargavan Impact Moderate Products Firefox, Firefox ESR, Firefox OS, SeaMonkey, T ...

It was found that NSS permitted skipping of the ServerKeyExchange packet during a handshake involving ECDHE (Elliptic Curve Diffie-Hellman key Exchange) A remote attacker could use this flaw to bypass the forward-secrecy of a TLS/SSL connection ...

script to manage ca-certificates.

Updating the CA trust list in RHEL Author: Kai Engert Date: August/September/October 2018 Updating the CA trust list in RHEL Introduction Distribution mechanics Related background information Script certdata-upstream-to-certdata-rhelpy RHEL 5 App A Script doitsh App B Script sort-bundlepy App C 2019 Update with new scripts Introduction In RHEL we ship Mozill

CWE-310 http://www.mozilla.org/security/announce/2015/mfsa2015-71.html https://smacktls.com https://bugzilla.mozilla.org/show_bug.cgi?id=1086145 https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19_release_notes http://www.debian.org/security/2015/dsa-3324 http://www.debian.org/security/2015/dsa-3336 http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.html http://www.ubuntu.com/usn/USN-2673-1 http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html http://www.securityfocus.com/bid/91787 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html http://www.securityfocus.com/bid/83398 http://www.securityfocus.com/bid/75541 https://security.gentoo.org/glsa/201512-10 http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html http://rhn.redhat.com/errata/RHSA-2015-1664.html http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html http://www.ubuntu.com/usn/USN-2672-1 http://www.ubuntu.com/usn/USN-2656-2 http://www.ubuntu.com/usn/USN-2656-1 http://www.securitytracker.com/id/1032784 http://www.securitytracker.com/id/1032783 http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html https://security.gentoo.org/glsa/201701-46 http://rhn.redhat.com/errata/RHSA-2015-1185.html https://nvd.nist.gov https://www.debian.org/security/./dsa-3336 https://github.com/rjrelyea/ca-certificate-scripts https://access.redhat.com/security/cve/cve-2015-2721 https://usn.ubuntu.com/2672-1/

CVE-2015-2721

Vulnerability Summary

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect