CVE-2015-7575

MediumCVSS 5.9/10Last modified Oct 14, 2026

Description

Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-19

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Jan 9, 2016
Last modified
Oct 14, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-75763.7The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implemeCVE-2015-75775.3activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x beforCVE-2015-75786.1Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.x and 5.x allows remote attackerCVE-2015-75796.1Cross-site scripting (XSS) vulnerability in the rails-html-sanitizer gem 1.0.2 for Ruby on Rails 4.2.x and 5.x allows remote attackers to inCVE-2015-75806.1Cross-site scripting (XSS) vulnerability in lib/rails/html/scrubbers.rb in the rails-html-sanitizer gem before 1.0.3 for Ruby on Rails 4.2.xCVE-2015-75817.5actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows rCVE-2015-75967.8SafeNet Authentication Service End User Software Tools for Windows uses a weak ACL for unspecified installation directories and executable mCVE-2015-75977.8SafeNet Authentication Service IIS Agent uses a weak ACL for unspecified installation directories and executable modules, which allows localCVE-2015-75987.8SafeNet Authentication Service TokenValidator Proxy Agent uses a weak ACL for unspecified installation directories and executable modules, wCVE-2015-75998.1Integer overflow in the _authenticate function in svc_auth.c in Wind River VxWorks 5.5 through 6.9.4.1, when the Remote Procedure Call (RPC)CVE-2015-76007.2Cisco VPN Client 5.x through 5.0.07.0440 uses weak permissions for vpnclient.ini, which allows local users to gain privileges by entering anCVE-2015-76017.8Directory traversal vulnerability in PCMan's FTP Server 2.0.7 allows remote attackers to read arbitrary files via a ..// (dot dot double sla
CVE-2015-7575: Medium severity, CVSS 5.9 | Vulnix