CVE-2015-2741: mozilla firefox Cryptographic Issues
Vulnerability summary
CVE-2015-2741 is a medium (CVSS 4.3) Cryptographic Issues vulnerability in mozilla firefox. EPSS estimates a 1.31% chance of exploitation in the next 30 days, higher than 70.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 6 · Related 4Timeline
- 06-07-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 do not enforce key pinning upon encountering an X.509 certificate problem that generates a user dialog, which allows user-assisted man-in-the-middle attackers to bypass intended access restrictions by triggering a (1) expired certificate or (2) mismatched hostname for a domain with pinning enabled.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
1.31%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
0.00 pp
From 1.31% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Mozilla2 products
- firefox≤ 38.1.0 | 31.0 | 31.1.0 | 31.1.1 | 31.3.0 | 31.5.1 | 31.5.2 | 31.5.3 | 38.0
- firefox_esr31.1 | 31.2 | 31.3 | 31.4 | 31.5 | 31.6.0 | 31.7.0
Ubuntu2 products
- firefox< 39.0+build5-0ubuntu0.14.04.1
- thunderbird< 1:31.8.0+build1-0ubuntu0.14.04.1
Oracle1 product
- solarisEOL11.3
3 vendors · 5 products
References
18 links- www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlX Refsource CONFIRMThird Party Advisory
Show all 18 references
- www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.htmlX Refsource CONFIRMThird Party Advisory