NVD

Id
24723  
Name
CVE-2015-2721  
Description
Mozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, Thunderbird before 38.1, and other products, does not properly determine state transitions for the TLS state machine, which allows man-in-the-middle attackers to defeat cryptographic protection mechanisms by blocking messages, as demonstrated by removing a forward-secrecy property by blocking a ServerKeyExchange message, aka a "SMACK SKIP-TLS" issue.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:N/I:P/A:N)  
Pub Date
2017-01-19  
Published
2015-07-05  
Modified Date
2016-12-27  
Seq
2015-2721  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
130236 24723 CVE-2015-2721 openSUSE-SU-2015:1229  View
130237 24723 CVE-2015-2721 openSUSE-SU-2015:1266  View
130238 24723 CVE-2015-2721 SUSE-SU-2015:1268  View
130239 24723 CVE-2015-2721 SUSE-SU-2015:1269  View
130240 24723 CVE-2015-2721 SUSE-SU-2015:1449  View
130241 24723 CVE-2015-2721 RHSA-2015:1664  View
130242 24723 CVE-2015-2721 DSA-3324  View
130243 24723 CVE-2015-2721 DSA-3336  View
130244 24723 CVE-2015-2721 http://www.mozilla.org/security/announce/2015/mfsa2015-71.html  View
130245 24723 CVE-2015-2721 http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html  View
130246 24723 CVE-2015-2721 http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html  View
130247 24723 CVE-2015-2721 http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html  View
130248 24723 CVE-2015-2721 http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html  View
130249 24723 CVE-2015-2721 http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html  View
130250 24723 CVE-2015-2721 75541  View
130251 24723 CVE-2015-2721 83398  View
130252 24723 CVE-2015-2721 91787  View
130253 24723 CVE-2015-2721 1032783  View
130254 24723 CVE-2015-2721 1032784  View
130255 24723 CVE-2015-2721 USN-2656-1  View
130256 24723 CVE-2015-2721 USN-2656-2  View
130257 24723 CVE-2015-2721 USN-2672-1  View
130258 24723 CVE-2015-2721 USN-2673-1  View
130259 24723 CVE-2015-2721 https://bugzilla.mozilla.org/show_bug.cgi?id=1086145  View
130260 24723 CVE-2015-2721 https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19_release_notes  View
130261 24723 CVE-2015-2721 GLSA-201512-10  View
130262 24723 CVE-2015-2721 https://smacktls.com  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
8117 JVNDB-2015-003437 Mozilla 製品などで使用される Mozilla Network Security Services における暗号保護メカニズムを破られる脆弱性 Mozilla Firefox、Thunderbird およびその他の製品で使用される Mozilla Network Security Services (NSS) は、TLS ステートマシンのステートの遷移を適切に判定しないため、暗号保護メカニズムを破られる脆弱性が存在します。 CVE-2015-2721 79946 CVE-2015-2721 24723 4.3 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-003437.html 2015-07-02 2016-08-22 View