CVEvulnerability
CVE-2015-2721
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-07-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-310
Description
Mozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, Thunderbird before 38.1, and other products, does not properly determine state transitions for the TLS state machine, which allows man-in-the-middle attackers to defeat cryptographic protection mechanisms by blocking messages, as demonstrated by removing a forward-secrecy property by blocking a ServerKeyExchange message, aka a "SMACK SKIP-TLS" issue.
Affected configurations
• novell suse linux enterprise software development kit 12.0
• canonical ubuntu linux 12.04
• canonical ubuntu linux 14.04
• canonical ubuntu linux 14.10
• canonical ubuntu linux 15.04
• debian debian linux 7.0
• debian debian linux 8.0
• novell suse linux enterprise desktop 12.0
• novell suse linux enterprise server 11
• novell suse linux enterprise server 12.0
• mozilla network security services 3.19
• oracle solaris 11.3
• oracle vm server 3.2
Related
Weakness · not in database (1)
References
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html lists.opensuse.org
- http://rhn.redhat.com/errata/RHSA-2015-1185.html rhn.redhat.com
- http://rhn.redhat.com/errata/RHSA-2015-1664.html rhn.redhat.com
- http://www.debian.org/security/2015/dsa-3324 Third Party Advisory
- http://www.debian.org/security/2015/dsa-3336 Third Party Advisory
- http://www.mozilla.org/security/announce/2015/mfsa2015-71.html Vendor Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html Third Party Advisory
- http://www.securityfocus.com/bid/75541 www.securityfocus.com
- http://www.securityfocus.com/bid/83398 www.securityfocus.com
- http://www.securityfocus.com/bid/91787 Third Party Advisory
- http://www.securitytracker.com/id/1032783 www.securitytracker.com
- http://www.securitytracker.com/id/1032784 www.securitytracker.com
- http://www.ubuntu.com/usn/USN-2656-1 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-2656-2 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-2672-1 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-2673-1 Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1086145 Exploit, Issue Tracking, VDB Entry, Vendor Advisory
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19_release_notes Release Notes
- https://security.gentoo.org/glsa/201512-10 security.gentoo.org
- https://security.gentoo.org/glsa/201701-46 security.gentoo.org
- https://smacktls.com Technical Description
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.html Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html lists.opensuse.org
- http://rhn.redhat.com/errata/RHSA-2015-1185.html rhn.redhat.com
- http://rhn.redhat.com/errata/RHSA-2015-1664.html rhn.redhat.com
- http://www.debian.org/security/2015/dsa-3324 Third Party Advisory
- http://www.debian.org/security/2015/dsa-3336 Third Party Advisory
- http://www.mozilla.org/security/announce/2015/mfsa2015-71.html Vendor Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html Third Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html Third Party Advisory
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html Third Party Advisory
- http://www.securityfocus.com/bid/75541 www.securityfocus.com
- http://www.securityfocus.com/bid/83398 www.securityfocus.com
- http://www.securityfocus.com/bid/91787 Third Party Advisory
- http://www.securitytracker.com/id/1032783 www.securitytracker.com
- http://www.securitytracker.com/id/1032784 www.securitytracker.com
- http://www.ubuntu.com/usn/USN-2656-1 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-2656-2 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-2672-1 www.ubuntu.com
- http://www.ubuntu.com/usn/USN-2673-1 Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1086145 Exploit, Issue Tracking, VDB Entry, Vendor Advisory
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19_release_notes Release Notes
- https://security.gentoo.org/glsa/201512-10 security.gentoo.org
- https://security.gentoo.org/glsa/201701-46 security.gentoo.org
- https://smacktls.com Technical Description