CVE-2015-2741
Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 do not enforce key pinning upon encountering an X.509 certificate problem that generates a user dialog, which allows user-assisted man-in-the-middle attackers to…
Does this matter?
Lower severity and a low EPSS score (1.31%). Track it; it rarely justifies an emergency change on its own.
Description
Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 do not enforce key pinning upon encountering an X.509 certificate problem that generates a user dialog, which allows user-assisted man-in-the-middle attackers to bypass intended access restrictions by triggering a (1) expired certificate or (2) mismatched hostname for a domain with pinning enabled.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 1.31% probability · 69th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-310
- Affected
- mozilla/firefox · oracle/solaris · mozilla/firefox esr
- Source
- security@mozilla.org
References
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html
- http://rhn.redhat.com/errata/RHSA-2015-1207.html
- http://rhn.redhat.com/errata/RHSA-2015-1455.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-67.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlThird Party Advisory
- http://www.securityfocus.com/bid/75541
- http://www.securitytracker.com/id/1032783
- http://www.securitytracker.com/id/1032784
- http://www.ubuntu.com/usn/USN-2656-1
- http://www.ubuntu.com/usn/USN-2656-2
- https://bugzilla.mozilla.org/show_bug.cgi?id=1147497Issue Tracking, Vendor Advisory
- https://security.gentoo.org/glsa/201512-10
- http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html
- http://rhn.redhat.com/errata/RHSA-2015-1207.html
- http://rhn.redhat.com/errata/RHSA-2015-1455.html
- http://www.mozilla.org/security/announce/2015/mfsa2015-67.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlThird Party Advisory
- http://www.securityfocus.com/bid/75541
- http://www.securitytracker.com/id/1032783
- http://www.securitytracker.com/id/1032784
- http://www.ubuntu.com/usn/USN-2656-1
- http://www.ubuntu.com/usn/USN-2656-2
- https://bugzilla.mozilla.org/show_bug.cgi?id=1147497Issue Tracking, Vendor Advisory
- https://security.gentoo.org/glsa/201512-10
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.