4.3

CVE-2015-4000: apple iphone_os Cryptographic Issues

Modified
AliasesMGASA-2015-0260SUSE-SU-2015:1482-1SUSE-SU-2015:1526-1
Published 21-05-2015Last modified 27-05-2026

Vulnerability summary

CVE-2015-4000 is a medium (CVSS 4.3) Cryptographic Issues vulnerability in apple iphone_os. EPSS estimates a 99.86% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritiseweaponized exploit

Weaponized exploit (Metasploit, 14-10-2014)

Source freshness unavailable

How is this decided?
CVSS score
4.3/10
010
Medium · v2.0 (NVD)
EPSS score
99.86%
0%100%
Critical · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1metasploit

Advisory lineage

Upstream 0 · Downstream 63 · Duplicates 1 · Related 42
DLA-247-1DLA-303-1DSA-3287-1DSA-3300-1DSA-3316-1DSA-3324-1

Timeline

  1. 21-05-2015
    PublishedVulnerability first disclosed.
  2. 27-05-2026
    Last modifiedVulnerability information updated.

Description

The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by DHE_EXPORT and then rewriting a ServerHello with DHE_EXPORT replaced by DHE, aka the "Logjam" issue.

CVSS metrics

10 scores · 7 sources · 3 versions

EPSS trend

Probability

99.86%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 99.86% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • MetasploitMetasploitremoteUnverified

    SSL/TLS Version Detection

    auxiliary/scanner/ssl/ssl_version

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Suse56 products
  • gnutls&distro=SUSE Linux Enterprise Desktop 11 SP3< 2.4.1-24.39.57.1
  • gnutls&distro=SUSE Linux Enterprise Desktop 11 SP4< 2.4.1-24.39.57.1
  • gnutls&distro=SUSE Linux Enterprise High Availability Extension 11 SP3< 2.4.1-24.39.57.1
  • gnutls&distro=SUSE Linux Enterprise High Availability Extension 11 SP4< 2.4.1-24.39.57.1
  • gnutls&distro=SUSE Linux Enterprise Server 11 SP3< 2.4.1-24.39.57.1
Mozilla6 products
Redhat6 products
  • openssl< 0:1.0.1e-30.el6_6.9 | < 1:1.0.1e-42.el7_1.6 | < 1:1.0.1e-42.ael7b_1.6
  • openssl-debuginfo< 0:1.0.1e-30.el6_6.9 | < 1:1.0.1e-42.el7_1.6 | < 1:1.0.1e-42.ael7b_1.6
  • openssl-devel< 0:1.0.1e-30.el6_6.9 | < 1:1.0.1e-42.el7_1.6 | < 1:1.0.1e-42.ael7b_1.6
  • openssl-libs< 1:1.0.1e-42.el7_1.6 | < 1:1.0.1e-42.ael7b_1.6
  • openssl-perl< 0:1.0.1e-30.el6_6.9 | < 1:1.0.1e-42.el7_1.6 | < 1:1.0.1e-42.ael7b_1.6
Ubuntu6 products
  • firefox< 39.0+build5-0ubuntu0.14.04.1
  • nss< 2:3.19.2-0ubuntu0.14.04.1 | < 2:3.19.2-1ubuntu1
  • openjdk-6< 6b36-1.13.8-0ubuntu1~14.04
  • openjdk-7< 7u79-2.5.6-0ubuntu1.14.04.1
  • openssl< 1.0.1f-1ubuntu2.12
Oracle4 products
  • jdk1.6.0:update95 | 1.7.0:update75 | 1.7.0:update80 | 1.8.0:update_33 | 1.8.0:update45
  • jre1.6.0:update_95 | 1.7.0:update_75 | 1.7.0:update_80 | 1.8.0:update_33 | 1.8.0:update_45
  • jrockitr28.3.6
  • sparc-opl_service_processor≤ 1121
Apple3 products
Debian3 products
  • nss< 2:3.19.1-1 | < 2:3.14.5-1+deb7u7
  • openssl< 1.0.2b-1
  • debian_linuxEOL7.0 | 8.0
Chainguard2 products
  • chromiumAll versions (No fix recorded)
  • firefoxAll versions (No fix recorded)
Mageia2 products
  • filezilla< 3.11.0.2-1.mga4
  • filezilla< 3.11.0.2-1.mga5
Wolfi2 products
  • chromiumAll versions (No fix recorded)
  • firefoxAll versions (No fix recorded)
Canonical1 product
Google1 product
Hp1 product
Ibm1 product
Microsoft1 product
Openssl1 product
  • openssl≥ 1.0.1, ≤ 1.0.1m | ≥ 1.0.2, ≤ 1.0.2a | ≤ 1.0.1m
Opera1 product

17 vendors · 97 products

References

263 links
Show all 100 references

Showing 100 of 263.