CVE-2015-2721 - CVE House
Back to Database
Status published Medium CVE-2015-2721

Mozilla Network Security Services (NSS) before 3.19, as used in...

Vulnerability Description

Mozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, Thunderbird before 38.1, and other products, does not properly determine state transitions for the TLS state machine, which allows man-in-the-middle attackers to defeat cryptographic protection mechanisms by blocking messages, as demonstrated by removing a forward-secrecy property by blocking a ServerKeyExchange message, aka a "SMACK SKIP-TLS" issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-2721

Credits & Attribution

No credits recorded in the NVD database.

References

More from novell

View All →
CVE-2016-7052
crypto/x509/x509_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a...
High 7.5
CVE-2016-5762
Integer overflow in the Post Office Agent in Novell GroupWise...
Critical 9.8
CVE-2016-5761
Cross-site scripting (XSS) vulnerability in Novell GroupWise before 2014 R2...
Medium 6.1
CVE-2016-5760
Multiple cross-site scripting (XSS) vulnerabilities in the administrator console in...
Medium 6.1
CVE-2016-5759
The mkdumprd script called "dracut" in the current working directory...
High 7.8

Affected Vendor

Affected Software

suse linux enterprise software development kit, ubuntu linux, debian linux, suse linux enterprise desktop, suse linux enterprise server, network security services, solaris, vm server
Vulnerable Versions:
12.0, 12.04, 14.04, 14.10, 15.04, 7.0, 8.0, 11, 3.19, 11.3, 3.2

Timeline

Official Publish: July 6th, 2015
Last Modified: August 6th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.