CVE-2015-2741

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 do not enforce key pinning upon encountering an X.509 certificate problem that generates a user dialog, which allows user-assisted man-in-the-middle attackers to bypass intended access restrictions by triggering a (1) expired certificate or (2) mismatched hostname for a domain with pinning enabled.

References

http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html

http://rhn.redhat.com/errata/RHSA-2015-1207.html

http://rhn.redhat.com/errata/RHSA-2015-1455.html

http://www.mozilla.org/security/announce/2015/mfsa2015-67.html

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html

http://www.securityfocus.com/bid/75541

http://www.securitytracker.com/id/1032783

http://www.securitytracker.com/id/1032784

http://www.ubuntu.com/usn/USN-2656-1

http://www.ubuntu.com/usn/USN-2656-2

https://bugzilla.mozilla.org/show_bug.cgi?id=1147497

https://security.gentoo.org/glsa/201512-10

Details

Source: MITRE

Published: 2015-07-06

Updated: 2016-12-28

Type: CWE-310

Risk Information

CVSS v2

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

Tenable Plugins

View all (22 total)

IDNameProductFamilySeverity
87710GLSA-201512-10 : Mozilla Products: Multiple vulnerabilities (Bar Mitzvah) (Logjam)NessusGentoo Local Security Checks
critical
8879Mozilla Thunderbird < 38.1 Multiple Vulnerabilities (Logjam)Nessus Network MonitorSMTP Clients
critical
8855Mozilla Firefox < 39.0 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
critical
84895Scientific Linux Security Update : thunderbird on SL5.x, SL6.x, SL7.x i386/x86_64 (20150720)NessusScientific Linux Local Security Checks
critical
84893RHEL 5 / 6 / 7 : thunderbird (RHSA-2015:1455)NessusRed Hat Local Security Checks
critical
84890Oracle Linux 6 / 7 : thunderbird (ELSA-2015-1455)NessusOracle Linux Local Security Checks
critical
84884CentOS 5 / 6 / 7 : thunderbird (CESA-2015:1455)NessusCentOS Local Security Checks
critical
84864openSUSE Security Update : MozillaThunderbird (openSUSE-2015-495) (Logjam)NessusSuSE Local Security Checks
low
84794Ubuntu 12.04 LTS : firefox vulnerabilities (USN-2656-2) (Logjam)NessusUbuntu Local Security Checks
low
84780FreeBSD : mozilla -- multiple vulnerabilities (44d9daee-940c-4179-86bb-6e3ffd617869) (Logjam)NessusFreeBSD Local Security Checks
low
84720openSUSE Security Update : MozillaFirefox / mozilla-nss (openSUSE-2015-480) (Logjam)NessusSuSE Local Security Checks
low
84664Ubuntu 14.04 LTS / 14.10 / 15.04 : firefox vulnerabilities (USN-2656-1) (Logjam)NessusUbuntu Local Security Checks
low
84582Mozilla Thunderbird < 38.1 Multiple Vulnerabilities (Logjam)NessusWindows
critical
84581Firefox < 39.0 Multiple Vulnerabilities (Logjam)NessusWindows
critical
84580Firefox ESR < 38.1 Multiple Vulnerabilities (Logjam)NessusWindows
critical
84578Mozilla Thunderbird < 38.1 Multiple Vulnerabilities (Mac OS X) (Logjam)NessusMacOS X Local Security Checks
critical
84577Firefox < 39.0 Multiple Vulnerabilities (Mac OS X) (Logjam)NessusMacOS X Local Security Checks
critical
84576Firefox ESR < 38.1 Multiple Vulnerabilities (Mac OS X) (Logjam)NessusMacOS X Local Security Checks
critical
84550CentOS 5 / 6 / 7 : firefox (CESA-2015:1207)NessusCentOS Local Security Checks
critical
84543Scientific Linux Security Update : firefox on SL5.x, SL6.x, SL7.x i386/x86_64 (20150703)NessusScientific Linux Local Security Checks
critical
84535RHEL 5 / 6 / 7 : firefox (RHSA-2015:1207)NessusRed Hat Local Security Checks
critical
84534Oracle Linux 5 / 6 / 7 : firefox (ELSA-2015-1207)NessusOracle Linux Local Security Checks
critical