CVE-2015-7575: Canonical Ubuntu Linux

Medium severity, CVSS 5.9. EPSS: 2.9% chance of exploitation in the next 30 days.

Mozilla Network Security Services (NSS) before 3.20.2, as used in Mozilla Firefox before 43.0.2 and Firefox ESR 38.x before 38.5.2, does not reject MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic, which makes it easier for man-in-the-middle attackers to spoof servers by triggering a collision.

Affected products

• Canonical Ubuntu Linux: version 14.04 only; version 15.04 only; version 15.10 only
• Mozilla Firefox: version 38.0 only; version 38.0.1 only; version 38.0.5 only; version 38.1.0 only; version 38.1.1 only; version 38.2.0 only; …
• Mozilla Network Security Services: up to and including 3.20.1
• Opensuse Leap: version 42.1 only
• Opensuse Opensuse: version 13.1 only; version 13.2 only

Published 2016-01-09. Last modified 2026-06-17.