CVE-2015-2721
Mozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, Thunderbird before 38.1, and other products, does not properly determine state transitions for the TLS state…
Does this matter?
Lower severity and a low EPSS score (3.28%). Track it; it rarely justifies an emergency change on its own.
Description
Mozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, Thunderbird before 38.1, and other products, does not properly determine state transitions for the TLS state machine, which allows man-in-the-middle attackers to defeat cryptographic protection mechanisms by blocking messages, as demonstrated by removing a forward-secrecy property by blocking a ServerKeyExchange message, aka a "SMACK SKIP-TLS" issue.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 3.28% probability · 88th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-310
- Affected
- novell/suse linux enterprise software development kit · canonical/ubuntu linux · debian/debian linux · novell/suse linux enterprise desktop · novell/suse linux enterprise server · mozilla/network security services · oracle/solaris · oracle/vm server
- Source
- security@mozilla.org
References
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html
- http://rhn.redhat.com/errata/RHSA-2015-1185.html
- http://rhn.redhat.com/errata/RHSA-2015-1664.html
- http://www.debian.org/security/2015/dsa-3324Third Party Advisory
- http://www.debian.org/security/2015/dsa-3336Third Party Advisory
- http://www.mozilla.org/security/announce/2015/mfsa2015-71.htmlVendor Advisory
- http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.htmlThird Party Advisory
- http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.htmlThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.htmlThird Party Advisory
- http://www.securityfocus.com/bid/75541
- http://www.securityfocus.com/bid/83398
- http://www.securityfocus.com/bid/91787Third Party Advisory
- http://www.securitytracker.com/id/1032783
- http://www.securitytracker.com/id/1032784
- http://www.ubuntu.com/usn/USN-2656-1
- http://www.ubuntu.com/usn/USN-2656-2
- http://www.ubuntu.com/usn/USN-2672-1
- http://www.ubuntu.com/usn/USN-2673-1Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1086145Exploit, Issue Tracking, VDB Entry, Vendor Advisory
- https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19_release_notesRelease Notes
- https://security.gentoo.org/glsa/201512-10
- https://security.gentoo.org/glsa/201701-46
- https://smacktls.comTechnical Description
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.