CVE-2015-2730
NSS: ECDSA signature validation fails to handle some signatures correctly (MFSA 2015-64)
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Mozilla Network Security Services (NSS) before 3.19.1, as used in Mozilla Firefox before 39.0, Firefox ESR 31.x before 31.8 and 38.x before 38.1, and other products, does not properly perform Elliptical Curve Cryptography (ECC) multiplications, which makes it easier for remote attackers to spoof ECDSA signatures via unspecified vectors.
Mozilla Network Security Services (NSS) anterior a 3.19.1, utilizado en Mozilla Firefox anterior a 39.0, Firefox ESR 31.x anterior a 31.8 y 38.x anterior a 38.1, y otros productos, no realiza correctamente las multiplicaciones Elliptical Curve Cryptography (ECC), lo que facilita a atacantes remotos falsificar firmas ECDSA a través de vectores no especificados.
A flaw was found in the way NSS verified certain ECDSA (Elliptic Curve Digital Signature Algorithm) signatures. Under certain conditions, an attacker could use this flaw to conduct signature forgery attacks.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2015-03-25 CVE Reserved
- 2015-07-06 CVE Published
- 2023-08-04 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-310: Cryptographic Issues
- CWE-347: Improper Verification of Cryptographic Signature
CAPEC
References (23)
URL | Tag | Source |
---|---|---|
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html | Third Party Advisory | |
http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html | Third Party Advisory | |
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html | Third Party Advisory | |
http://www.securityfocus.com/bid/75541 | Vdb Entry | |
http://www.securityfocus.com/bid/83399 | Vdb Entry | |
http://www.securitytracker.com/id/1032783 | Vdb Entry | |
https://bugzilla.mozilla.org/show_bug.cgi?id=1125025 | Issue Tracking |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Mozilla Search vendor "Mozilla" | Network Security Services Search vendor "Mozilla" for product "Network Security Services" | <= 3.19 Search vendor "Mozilla" for product "Network Security Services" and version " <= 3.19" | - |
Affected
| in | Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | <= 38.1.0 Search vendor "Mozilla" for product "Firefox" and version " <= 38.1.0" | - |
Safe
|
Mozilla Search vendor "Mozilla" | Network Security Services Search vendor "Mozilla" for product "Network Security Services" | <= 3.19 Search vendor "Mozilla" for product "Network Security Services" and version " <= 3.19" | - |
Affected
| in | Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 31.0 Search vendor "Mozilla" for product "Firefox Esr" and version "31.0" | - |
Safe
|
Mozilla Search vendor "Mozilla" | Network Security Services Search vendor "Mozilla" for product "Network Security Services" | <= 3.19 Search vendor "Mozilla" for product "Network Security Services" and version " <= 3.19" | - |
Affected
| in | Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 31.1 Search vendor "Mozilla" for product "Firefox Esr" and version "31.1" | - |
Safe
|
Mozilla Search vendor "Mozilla" | Network Security Services Search vendor "Mozilla" for product "Network Security Services" | <= 3.19 Search vendor "Mozilla" for product "Network Security Services" and version " <= 3.19" | - |
Affected
| in | Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 31.1.0 Search vendor "Mozilla" for product "Firefox Esr" and version "31.1.0" | - |
Safe
|
Mozilla Search vendor "Mozilla" | Network Security Services Search vendor "Mozilla" for product "Network Security Services" | <= 3.19 Search vendor "Mozilla" for product "Network Security Services" and version " <= 3.19" | - |
Affected
| in | Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 31.1.1 Search vendor "Mozilla" for product "Firefox Esr" and version "31.1.1" | - |
Safe
|
Mozilla Search vendor "Mozilla" | Network Security Services Search vendor "Mozilla" for product "Network Security Services" | <= 3.19 Search vendor "Mozilla" for product "Network Security Services" and version " <= 3.19" | - |
Affected
| in | Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 31.2 Search vendor "Mozilla" for product "Firefox Esr" and version "31.2" | - |
Safe
|
Mozilla Search vendor "Mozilla" | Network Security Services Search vendor "Mozilla" for product "Network Security Services" | <= 3.19 Search vendor "Mozilla" for product "Network Security Services" and version " <= 3.19" | - |
Affected
| in | Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 31.3 Search vendor "Mozilla" for product "Firefox Esr" and version "31.3" | - |
Safe
|
Mozilla Search vendor "Mozilla" | Network Security Services Search vendor "Mozilla" for product "Network Security Services" | <= 3.19 Search vendor "Mozilla" for product "Network Security Services" and version " <= 3.19" | - |
Affected
| in | Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 31.3.0 Search vendor "Mozilla" for product "Firefox Esr" and version "31.3.0" | - |
Safe
|
Mozilla Search vendor "Mozilla" | Network Security Services Search vendor "Mozilla" for product "Network Security Services" | <= 3.19 Search vendor "Mozilla" for product "Network Security Services" and version " <= 3.19" | - |
Affected
| in | Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 31.4 Search vendor "Mozilla" for product "Firefox Esr" and version "31.4" | - |
Safe
|
Mozilla Search vendor "Mozilla" | Network Security Services Search vendor "Mozilla" for product "Network Security Services" | <= 3.19 Search vendor "Mozilla" for product "Network Security Services" and version " <= 3.19" | - |
Affected
| in | Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 31.5 Search vendor "Mozilla" for product "Firefox Esr" and version "31.5" | - |
Safe
|
Mozilla Search vendor "Mozilla" | Network Security Services Search vendor "Mozilla" for product "Network Security Services" | <= 3.19 Search vendor "Mozilla" for product "Network Security Services" and version " <= 3.19" | - |
Affected
| in | Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 31.5.1 Search vendor "Mozilla" for product "Firefox Esr" and version "31.5.1" | - |
Safe
|
Mozilla Search vendor "Mozilla" | Network Security Services Search vendor "Mozilla" for product "Network Security Services" | <= 3.19 Search vendor "Mozilla" for product "Network Security Services" and version " <= 3.19" | - |
Affected
| in | Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 31.5.2 Search vendor "Mozilla" for product "Firefox Esr" and version "31.5.2" | - |
Safe
|
Mozilla Search vendor "Mozilla" | Network Security Services Search vendor "Mozilla" for product "Network Security Services" | <= 3.19 Search vendor "Mozilla" for product "Network Security Services" and version " <= 3.19" | - |
Affected
| in | Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 31.5.3 Search vendor "Mozilla" for product "Firefox Esr" and version "31.5.3" | - |
Safe
|
Mozilla Search vendor "Mozilla" | Network Security Services Search vendor "Mozilla" for product "Network Security Services" | <= 3.19 Search vendor "Mozilla" for product "Network Security Services" and version " <= 3.19" | - |
Affected
| in | Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 31.6.0 Search vendor "Mozilla" for product "Firefox Esr" and version "31.6.0" | - |
Safe
|
Mozilla Search vendor "Mozilla" | Network Security Services Search vendor "Mozilla" for product "Network Security Services" | <= 3.19 Search vendor "Mozilla" for product "Network Security Services" and version " <= 3.19" | - |
Affected
| in | Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 31.7.0 Search vendor "Mozilla" for product "Firefox Esr" and version "31.7.0" | - |
Safe
|
Mozilla Search vendor "Mozilla" | Network Security Services Search vendor "Mozilla" for product "Network Security Services" | <= 3.19 Search vendor "Mozilla" for product "Network Security Services" and version " <= 3.19" | - |
Affected
| in | Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | 38.0 Search vendor "Mozilla" for product "Firefox Esr" and version "38.0" | - |
Safe
|
Novell Search vendor "Novell" | Suse Linux Enterprise Software Development Kit Search vendor "Novell" for product "Suse Linux Enterprise Software Development Kit" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Software Development Kit" and version "12.0" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 7.0 Search vendor "Debian" for product "Debian Linux" and version "7.0" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||
Novell Search vendor "Novell" | Suse Linux Enterprise Desktop Search vendor "Novell" for product "Suse Linux Enterprise Desktop" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Desktop" and version "12.0" | - |
Affected
| ||||||
Novell Search vendor "Novell" | Suse Linux Enterprise Server Search vendor "Novell" for product "Suse Linux Enterprise Server" | 11 Search vendor "Novell" for product "Suse Linux Enterprise Server" and version "11" | sp4 |
Affected
| ||||||
Novell Search vendor "Novell" | Suse Linux Enterprise Server Search vendor "Novell" for product "Suse Linux Enterprise Server" | 12.0 Search vendor "Novell" for product "Suse Linux Enterprise Server" and version "12.0" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Solaris Search vendor "Oracle" for product "Solaris" | 11.3 Search vendor "Oracle" for product "Solaris" and version "11.3" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Vm Server Search vendor "Oracle" for product "Vm Server" | 3.2 Search vendor "Oracle" for product "Vm Server" and version "3.2" | - |
Affected
|