VDB
DEBIAN-CVE-2015-7575
DEBIAN-CVE-2015-7575
PUBLISHED
CVSS 5.900000095367432 MEDIUM
Record from OSV · Published January 9, 2016
Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| openssl | Debian:13 | 1.0.1f-1 |
| gnutls28 | Debian:13 | 3.3.15-1 |
| nss | Debian:12 | 2:3.21-1 |
| openssl | Debian:14 | 1.0.1f-1 |
| openssl | Debian:12 | 1.0.1f-1 |
| gnutls28 | Debian:12 | 3.3.15-1 |
| nss | Debian:13 | 2:3.21-1 |
| gnutls28 | Debian:14 | 3.3.15-1 |
| nss | Debian:14 | 2:3.21-1 |
Risk scores
CVSS 3.0
5.900000095367432
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:13 | openssl | 0 |
| Debian:13 | gnutls28 | 0 |
| Debian:12 | nss | 0 |
| Debian:14 | openssl | 0 |
| Debian:12 | openssl | 0 |
| Debian:12 | gnutls28 | 0 |
| Debian:13 | nss | 0 |
| Debian:14 | gnutls28 | 0 |
| Debian:14 | nss | 0 |
Timeline
- Jan 9, 2016 CVE Published
- Oct 15, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2015-7575
vulnetix vdb fixes DEBIAN-CVE-2015-7575Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2015-7575/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart