KLA10732 Security bypass vulnerability in Mozilla Firefox and Firefox ESR

Lack of security enforcement was found in Mozilla Firefox. By exploiting this vulnerability malicious users can conduct man-in-the-middle attack. This vulnerability can be exploited remotely via a collision-based attacks.

Technical details

This vulnerability caused by not rejecting MD5 signatures in TLS 1.2 Handshake Protocol traffic.

Original advisories

Mozilla advisory

Related products

Mozilla-Firefox

Mozilla-Firefox-ESR

CVE list

CVE-2015-7575 warning

Solution

Update to the latest versionDownload Firefox

Download Firefox ESR

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• LoI

Loss of integrity. Exploitation of vulnerabilities with this impact can lead to partial system fault or system components connection disruption.

Affected Products

• Firefox versions earlier than 43.0.2Firefox ESR versions earlier than 38.5.2