CVE:CVE-2015-7575
CNNVD:CNNVD-201512-603
Mozilla Firefox和Mozilla Firefox ESR都是美国Mozilla基金会的产品。Mozilla Firefox是一款开源Web浏览器。Mozilla Firefox ESR是Firefox(Web浏览器)的一个延长支持版本。
Mozilla Firefox和Firefox ESR中使用的Mozilla NSS中存在安全漏洞，该漏洞源于程序错误地接收TLS 1.2 Handshake Protocol流量中的Server Key Exchange消息中的MD5签名。攻击者可通过实施collision-based伪造攻击利用该漏洞实施中间人攻击，欺骗服务器。以下产品及版本受到影响：Mozilla Firefox 43.0.2之前版本，Firefox ESR 38.5.2之前38.x版本，NSS 3.20.2之前版本。
solution:Upgrade mozilla network_security_services to a higher version than 3.20.1,and avoid the version (,3.20.1]; Upgrade opensuse leap to a higher version than 42.1,and avoid the version 42.1; Upgrade opensuse opensuse to a higher version than 13.1,13.2,and avoid the version 13.1,13.2; Upgrade mozilla firefox_esr to a higher version than 38.0,38.0.1,38.0.5,38.1.0,38.1.1,38.2.0,38.2.1,38.3.0,38.4.0,38.5.0,38.5.1,and avoid the version 38.0,38.0.1,38.0.5,38.1.0,38.1.1,38.2.0,38.2.1,38.3.0,38.4.0,38.5.0,38.5.1; Upgrade canonical ubuntu_linux to a higher version than 14.04,15.04,15.10,and avoid the version 14.04,15.04,15.10; Upgrade mozilla firefox to a higher version than 43.0.1,and avoid the version (,43.0.1]