Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Aix 5.3 Java_jan2016_advisory | — | — | Aug 5, 2016 | Jan 8, 2016 |
| Aix 5.3 Openssl_advisory16 | — | — | Feb 4, 2016 | Jan 8, 2016 |
| Aix 5.3.12 Nettcp_advisory2 | — | — | Dec 19, 2016 | Jan 8, 2016 |
| Aix 6.1 Java_jan2016_advisory | — | — | Aug 5, 2016 | Jan 8, 2016 |
| Aix 6.1 Openssl_advisory16 | — | — | Feb 4, 2016 | Jan 8, 2016 |
| Aix 6.1.9 Nettcp_advisory2 | — | — | Dec 19, 2016 | Jan 8, 2016 |
| Aix 7.1 Java_jan2016_advisory | — | — | Aug 5, 2016 | Jan 8, 2016 |
| Aix 7.1 Openssl_advisory16 | — | — | Feb 4, 2016 | Jan 8, 2016 |
| Aix 7.1.3 Nettcp_advisory2 | — | — | Dec 19, 2016 | Jan 8, 2016 |
| Aix 7.1.4 Nettcp_advisory2 | — | — | Dec 19, 2016 | Jan 8, 2016 |
| Aix 7.2 Java_jan2016_advisory | — | — | Aug 5, 2016 | Jan 8, 2016 |
| Aix 7.2 Openssl_advisory16 | — | — | Feb 4, 2016 | Jan 8, 2016 |
| Aix 7.2.0 Nettcp_advisory2 | — | — | Dec 19, 2016 | Jan 8, 2016 |
| Alpine Linux | — | Upgrade nss | Aug 30, 2017 | Jan 31, 2016 |
| Amazon_linux | — | Upgrade gnutlsUpgrade java-1.7.0-openjdkUpgrade java-1.8.0-openjdkUpgrade opensslUpgrade nss | Apr 20, 2016 | Jan 8, 2016 |
| Azul Zulu | — | Apply legacy security update: Azul Zulu JDK 7 installer 7.13 (JDK 7u95, quarterly CPU) — Azul Legacy Production SupportUpgrade to Azul Zulu JDK 8 installer 8.12 (JDK 8u71, quarterly CPU) (LTS stream)Apply legacy security update: Azul Zulu JDK 6 installer 6.11 (JDK 6u77, quarterly CPU) — Azul Legacy Production Support | Jan 9, 2016 | Jan 9, 2016 |
| Centos_linux | — | Upgrade java-1.8.0-openjdk-accessibility-debugUpgrade gnutlsUpgrade nss-toolsUpgrade nssUpgrade nss-sysinitUpgrade gnutls-c++Upgrade nss-pkcs11-develUpgrade openssl-develUpgrade gnutls-guileUpgrade gnutls-utilsUpgrade java-1.8.0-openjdk-srcUpgrade nss-develUpgrade openssl-staticUpgrade opensslUpgrade java-1.7.0-openjdk-accessibilityUpgrade java-1.8.0-openjdk-accessibilityUpgrade java-1.7.0-openjdk-headlessUpgrade openssl-perlUpgrade java-1.7.0-openjdk-demoUpgrade java-1.8.0-openjdk-javadocUpgrade java-1.7.0-openjdk-srcUpgrade java-1.8.0-openjdk-develUpgrade java-1.7.0-openjdk-develUpgrade java-1.8.0-openjdk-src-debugUpgrade java-1.8.0-openjdk-devel-debugUpgrade java-1.7.0-openjdkUpgrade java-1.8.0-openjdk-demoUpgrade java-1.8.0-openjdk-headlessUpgrade java-1.8.0-openjdk-javadoc-debugUpgrade java-1.8.0-openjdk-debugUpgrade java-1.8.0-openjdk-demo-debugUpgrade java-1.8.0-openjdk-headless-debugUpgrade gnutls-develUpgrade java-1.8.0-openjdkUpgrade openssl-libsUpgrade java-1.7.0-openjdk-javadocUpgrade gnutls-dane | Jul 6, 2016 | Jan 8, 2016 |
| Debian | — | Upgrade openjdk-6Upgrade gnutls28Upgrade opensslUpgrade gnutls26Upgrade iceweaselUpgrade icedoveUpgrade nssUpgrade openjdk-7 | Feb 2, 2016 | Jan 8, 2016 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Jan 23, 2016 |
| Freebsd | — | Upgrade linux-thunderbirdUpgrade nssUpgrade linux-firefoxUpgrade linux-c6-nssUpgrade linux-seamonkey | Dec 10, 2025 | Dec 28, 2015 |
| Gentoo Linux | — | Upgrade net-libs/polarssl.Upgrade mail-client/thunderbird.Upgrade dev-libs/nspr.Upgrade net-libs/mbedtls.Upgrade www-client/firefox.Upgrade mail-client/thunderbird-bin.Upgrade www-client/firefox-bin.Upgrade dev-libs/nss. | Oct 30, 2017 | Jan 8, 2016 |
| Ibm Aix | — | Apply the fix or workaround for java_jan2016_advisoryApply the fix or workaround for openssl_advisory16Apply the fix or workaround for nettcp_advisory2 | Nov 30, 2017 | Jan 8, 2016 |
| Ibm Java | — | Upgrade IBM Java to version 6.1.8.20Upgrade IBM Java to version 8.0.2.10Upgrade IBM Java to version 6.0.16.20Upgrade IBM Java to version 7.1.3.30Upgrade IBM Java to version 7.0.9.30 | Oct 5, 2018 | Jan 9, 2016 |
| Ibm Was | — | Upgrade to minimal fix pack levels as required by interim fixes and then apply latest Interim Fix. | Apr 27, 2018 | Jan 9, 2016 |
| Jre Vuln | — | Upgrade to the latest version of Oracle Java | Jan 19, 2016 | Jan 8, 2016 |
| Mfsa2015 150 | — | Upgrade to Mozilla Firefox version 43.0.2Upgrade to Mozilla Firefox ESR version 38.6Upgrade to the latest version of Mozilla Firefox | Jan 7, 2016 | Dec 22, 2015 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 38.6Upgrade to the latest version of Mozilla Thunderbird | Feb 17, 2016 | Jan 8, 2016 |
| Oracle Solaris | — | Upgrade web/data/firefox-bookmarks to version 45.4.0-0.175.3.14.0.4.0 on Solaris 11.3Upgrade developer/yasm to version 1.3.0-0.175.3.14.0.2.0 on Solaris 11.3Upgrade mail/thunderbird/plugin/thunderbird-lightning to version 45.3.0-0.175.3.14.0.4.0 on Solaris 11.3Upgrade web/browser/firefox to version 45.4.0-0.175.3.14.0.4.0 on Solaris 11.3Upgrade mail/thunderbird to version 45.3.0-0.175.3.14.0.4.0 on Solaris 11.3 | May 29, 2017 | Jan 8, 2016 |
| Oracle_linux | — | Upgrade java-1.8.0-openjdk-accessibility-debugUpgrade nss-sysinitUpgrade java-1.7.0-openjdkUpgrade nss-develUpgrade gnutlsUpgrade java-1.8.0-openjdk-demoUpgrade gnutls-develUpgrade java-1.8.0-openjdk-srcUpgrade openssl-develUpgrade gnutls-utilsUpgrade nss-toolsUpgrade gnutls-daneUpgrade openssl-staticUpgrade java-1.8.0-openjdk-javadoc-debugUpgrade java-1.8.0-openjdk-develUpgrade java-1.7.0-openjdk-srcUpgrade gnutls-guileUpgrade openssl-perlUpgrade gnutls-c++Upgrade java-1.8.0-openjdk-javadocUpgrade openssl-libsUpgrade java-1.8.0-openjdk-headlessUpgrade java-1.7.0-openjdk-demoUpgrade java-1.7.0-openjdk-develUpgrade java-1.8.0-openjdk-demo-debugUpgrade java-1.7.0-openjdk-headlessUpgrade java-1.8.0-openjdk-headless-debugUpgrade java-1.7.0-openjdk-accessibilityUpgrade java-1.7.0-openjdk-javadocUpgrade java-1.8.0-openjdk-debugUpgrade java-1.8.0-openjdk-devel-debugUpgrade java-1.8.0-openjdk-src-debugUpgrade nss-pkcs11-develUpgrade nssUpgrade java-1.8.0-openjdk-accessibilityUpgrade opensslUpgrade java-1.8.0-openjdk | Mar 22, 2016 | Jan 9, 2016 |
| Suse | — | Upgrade java-1_6_0-ibm-pluginUpgrade mozilla-nss-sysinit-32bitUpgrade bouncycastleUpgrade MozillaFirefox-translations-otherUpgrade bouncycastle-pgUpgrade java-1_8_0-openjdk-demoUpgrade java-1_7_0-openjdk-develUpgrade MozillaFirefox-branding-SLEDUpgrade libsoftokn3Upgrade java-1_8_0-ibm-develUpgrade java-1_8_0-ibmUpgrade java-1_7_0-ibm-pluginUpgrade java-1_6_0-ibm-alsaUpgrade libfreebl3-x86Upgrade mozilla-nss-develUpgrade MozillaFirefox-develUpgrade java-1_7_0-ibm-jdbcUpgrade mozilla-nssUpgrade java-1_7_1-ibm-jdbcUpgrade java-1_7_0-ibm-alsaUpgrade java-1_8_0-openjdk-develUpgrade java-1_7_1-ibm-develUpgrade MozillaThunderbirdUpgrade mozilla-nss-toolsUpgrade java-1_6_0-ibm-fontsUpgrade java-1_7_1-ibm-pluginUpgrade java-1_8_0-ibm-pluginUpgrade MozillaThunderbird-translations-otherUpgrade mozilla-nss-sysinitUpgrade MozillaFirefox-translations-commonUpgrade MozillaThunderbird-develUpgrade MozillaFirefoxUpgrade libfreebl3Upgrade libfreebl3-32bitUpgrade java-1_6_0-ibm-develUpgrade mozilla-nss-32bitUpgrade java-1_7_1-ibm-alsaUpgrade libfreebl3-hmacUpgrade libsoftokn3-32bitUpgrade java-1_6_0-ibm-jdbcUpgrade java-1_8_0-openjdkUpgrade java-1_8_0-openjdk-headlessUpgrade java-1_7_0-ibmUpgrade mozilla-nss-x86Upgrade java-1_7_0-openjdkUpgrade MozillaThunderbird-translations-commonUpgrade libsoftokn3-hmac-32bitUpgrade java-1_7_0-openjdk-demoUpgrade java-1_7_0-openjdk-headlessUpgrade mozilla-nss-certsUpgrade java-1_8_0-ibm-alsaUpgrade libsoftokn3-hmacUpgrade java-1_7_0-ibm-develUpgrade mozilla-nss-certs-32bitUpgrade MozillaFirefox-translationsUpgrade libfreebl3-hmac-32bitUpgrade java-1_6_0-ibmUpgrade java-1_7_1-ibmUpgrade libsoftokn3-x86 | Jan 8, 2016 | Jan 8, 2016 |
| Ubuntu | — | Upgrade thunderbirdUpgrade firefoxUpgrade openjdk-7-jreUpgrade openjdk-7-jre-headlessUpgrade openjdk-7-jre-libUpgrade libgnutlsxx27Upgrade libgnutls26Upgrade libgnutlsxx28Upgrade icedtea-7-jre-jamvmUpgrade libnss3Upgrade openjdk-7-jre-zeroUpgrade libgnutls-openssl27Upgrade libssl1.0.0Upgrade libgnutls-deb0-28 | Feb 2, 2016 | Jan 8, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub