Security bypass vulnerability in Mozilla Firefox and Firefox ESR

Description

Lack of security enforcement was found in Mozilla Firefox. By exploiting this vulnerability malicious users can conduct man-in-the-middle attack. This vulnerability can be exploited remotely via a collision-based attacks.

---

Technical details

This vulnerability caused by not rejecting MD5 signatures in TLS 1.2 Handshake Protocol traffic.

Original advisories

• Mozilla advisory

Related products

• Mozilla-Firefox
• Mozilla-Firefox-ESR

CVE list

• CVE-2015-7575
  warning

Read more

Find out the statistics of the vulnerabilities spreading in your region on statistics.securelist.com