NVD

Id
23271  
Name
CVE-2015-0832  
Description
Mozilla Firefox before 36.0 does not properly recognize the equivalence of domain names with and without a trailing . (dot) character, which allows man-in-the-middle attackers to bypass the HPKP and HSTS protection mechanisms by constructing a URL with this character and leveraging access to an X.509 certificate for a domain with this character.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2015-02-25  
Modified Date
2016-12-21  
Seq
2015-0832  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
123558 23271 CVE-2015-0832 openSUSE-SU-2015:0404  View
123559 23271 CVE-2015-0832 openSUSE-SU-2015:0570  View
123560 23271 CVE-2015-0832 http://www.mozilla.org/security/announce/2015/mfsa2015-13.html  View
123561 23271 CVE-2015-0832 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html  View
123562 23271 CVE-2015-0832 72752  View
123563 23271 CVE-2015-0832 USN-2505-1  View
123564 23271 CVE-2015-0832 https://bugzilla.mozilla.org/show_bug.cgi?id=1065909  View
123565 23271 CVE-2015-0832 GLSA-201504-01  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
6290 JVNDB-2015-001610 Mozilla Firefox における HPKP および HSTS 保護メカニズムを回避される脆弱性 Mozilla Firefox は、ドメイン名の末尾に .(dot) 文字を持つ場合と持たない場合における同等性を適切に認識しないため、HPKP および HSTS 保護メカニズムを回避される脆弱性が存在します。 CVE-2015-0832 78043 CVE-2015-0832 23271 6.9 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-001610.html 2015-02-24 2015-02-26 View