CVE-2015-2741
Fixed in a distro release EPSS 1%
Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 do not enforce key pinning upon encountering an X.509 certificate problem that generates a user dialog, which allows user-assisted man-in-the-middle attackers to bypass intended access restrictions by triggering a (1) expired certificate or (2) mismatched hostname for a domain with pinning enabled.
Products: mozilla firefox, oracle solaris, mozilla firefox_esr
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 5 | firefox | 0:38.1.0-1.el5_11 |
| Red Hat Enterprise Linux 5 | firefox-debuginfo | 0:38.1.0-1.el5_11 |
| Red Hat Enterprise Linux 5 | thunderbird | 0:31.8.0-1.el5_11 |
| Red Hat Enterprise Linux 5 | thunderbird-debuginfo | 0:31.8.0-1.el5_11 |
| Red Hat Enterprise Linux 6 | firefox | 0:38.1.0-1.el6_6 |
| Red Hat Enterprise Linux 6 | firefox-debuginfo | 0:38.1.0-1.el6_6 |
| Red Hat Enterprise Linux 6 | thunderbird | 0:31.8.0-1.el6_6 |
| Red Hat Enterprise Linux 6 | thunderbird-debuginfo | 0:31.8.0-1.el6_6 |
| Red Hat Enterprise Linux 7 | firefox | 0:38.1.0-1.el7_1 |
| Red Hat Enterprise Linux 7 | firefox-debuginfo | 0:38.1.0-1.el7_1 |
| Red Hat Enterprise Linux 7 | thunderbird | 0:31.8.0-1.ael7b_1 |
| Red Hat Enterprise Linux 7 | thunderbird | 0:31.8.0-1.el7_1 |
| Red Hat Enterprise Linux 7 | thunderbird-debuginfo | 0:31.8.0-1.el7_1 |
| Red Hat Enterprise Linux 7 | thunderbird-debuginfo | 0:31.8.0-1.ael7b_1 |
| Red Hat rhel productivity 5 | thunderbird | 0:31.8.0-1.el5_11 |
| Red Hat rhel productivity 5 | thunderbird-debuginfo | 0:31.8.0-1.el5_11 |
| Ubuntu 14.04 LTS | firefox | 39.0+build5-0ubuntu0.14.04.1 |
| Ubuntu 14.04 LTS | thunderbird | 1:31.8.0+build1-0ubuntu0.14.04.1 |
| openSUSE Tumbleweed | MozillaFirefox | 50.1.0-1.1 |
| openSUSE Tumbleweed | MozillaThunderbird | 45.5.1-1.1 |
| openSUSE Tumbleweed | firefox-esr | 128.5.1-1.1 |