Home > Vulnerability Database > CVE-2015-2721

Mend.io Vulnerability Database

CVE-2015-2721

Date: July 5, 2015

Mozilla Network Security Services (NSS) before 3.19, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, Thunderbird before 38.1, and other products, does not properly determine state transitions for the TLS state machine, which allows man-in-the-middle attackers to defeat cryptographic protection mechanisms by blocking messages, as demonstrated by removing a forward-secrecy property by blocking a ServerKeyExchange message, aka a "SMACK SKIP-TLS" issue.

Language: Unix

Severity Score

3.7

Related Resources (34)

Url: http://rhn.redhat.com/errata/RHSA-2015-1664.html

Url: http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html

Url: https://nvd.nist.gov/vuln/detail/CVE-2015-2721

Url: https://access.redhat.com/security/cve/CVE-2015-2721

Url: http://www.debian.org/security/2015/dsa-3336

Url: http://www.oracle.com/technetwork/security-advisory/cpujul2016-2881720.html

Url: http://www.securityfocus.com/bid/75541

Url: https://security.gentoo.org/glsa/201512-10

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2015-2721

Url: https://smacktls.com

Url: https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.19_release_notes

Url: http://www.securityfocus.com/bid/83398

Url: https://security.gentoo.org/glsa/201701-46

Url: http://www.ubuntu.com/usn/USN-2656-1

Url: https://security-tracker.debian.org/tracker/CVE-2015-2721

Url: http://www.ubuntu.com/usn/USN-2656-2

Url: http://rhn.redhat.com/errata/RHSA-2015-1185.html

Url: http://www.debian.org/security/2015/dsa-3324

Url: http://www.mozilla.org/security/announce/2015/mfsa2015-71.html

Url: http://www.securityfocus.com/bid/91787

Url: http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html

Url: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00034.html

Url: http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html

Url: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00031.html

Url: https://bugzilla.mozilla.org/show_bug.cgi?id=1086145

Url: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00025.html

Url: http://www.securitytracker.com/id/1032784

Url: http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00033.html

Url: http://www.securitytracker.com/id/1032783

Url: http://www.ubuntu.com/usn/USN-2672-1

Url: http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00021.html

Url: http://www.ubuntu.com/usn/USN-2673-1

Url: http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Url: https://www.mend.io/vulnerability-database/CVE-2015-2721

Severity Score

3.7

Weakness Type (CWE)

Cryptographic Issues

CWE-310

CVSS v3.1

Base Score:	3.7
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	LOW
Availability (A):	NONE

CVSS v2

Base Score:	4.3
Access Vector (AV):	NETWORK
Access Complexity (AC):	MEDIUM
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	PARTIAL
Availability (A):	NONE
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2015-2721

Date: July 5, 2015

Language: Unix

Severity Score

Related Resources (34)

Severity Score

Weakness Type (CWE)

CVSS v3.1

CVSS v2

Do you need more information?