Mozilla Thunderbird CVE-2015-7575 Request Smuggling Vulnerability

description-logoDescription

Security researcher Karthikeyan Bhargavan reported an issue in Network Security Services (NSS) where MD5 signatures in the server signature within the TLS 1.2 ServerKeyExchange message are still accepted. This is an issue since NSS has officially disallowed the accepting MD5 as a hash algorithm in signatures since 2011. This issues exposes NSS based clients such as Firefox to theoretical collision-based forgery attacks. This issue was fixed in NSS version 3.20.2.

affected-products-logoAffected Applications

Thunderbird

CVE References

CVE-2015-7575