CVE-2015-5244

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175248.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176026.htmlThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1259216Issue Tracking, Third Party Advisory
https://pagure.io/mod_nss/c/34e1ccecb4a7d5054dba2f92b403af9b6ae1e110Patch, Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175248.htmlThird Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176026.htmlThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1259216Issue Tracking, Third Party Advisory
https://pagure.io/mod_nss/c/34e1ccecb4a7d5054dba2f92b403af9b6ae1e110Patch, Third Party Advisory

Timeline

Published: Aug 7, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-52454.3CRLF injection vulnerability in the Ceph Object Gateway (aka radosgw or RGW) in Ceph before 0.94.4 allows remote attackers to inject arbitra CVE-2015-52468.1The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors inv CVE-2015-52476.5The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a de CVE-2015-52486.5Reflected file download vulnerability in Red Hat Feedhenry Enterprise Mobile Application Platform.CVE-2015-52504.0The API server in OpenShift Origin 1.0.5 allows remote attackers to cause a denial of service (master process crash) via crafted JSON data.CVE-2015-52515.5OpenStack Image Service (Glance) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) allow remote authenticated users to change the s CVE-2015-52527.2vfs.c in smbd in Samba 3.x and 4.x before 4.1.22, 4.2.x before 4.2.7, and 4.3.x before 4.3.3, when share names with certain substring relati CVE-2015-52534.0The SAML Web SSO module in Apache CXF before 2.7.18, 3.0.x before 3.0.7, and 3.1.x before 3.1.3 allows remote authenticated users to bypass CVE-2015-52549.8Apache ActiveMQ 5.x before 5.13.0 does not restrict the classes that can be serialized in the broker, which allows remote attackers to execu CVE-2015-52554.3Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x CVE-2015-52564.3Apache Cordova-Android before 4.1.0, when an application relies on a remote server, improperly implements a JavaScript whitelist protection CVE-2015-52574.9drivers/usb/serial/whiteheat.c in the Linux kernel before 4.2.4 allows physically proximate attackers to cause a denial of service (NULL poi