Server spoofing vulnerability in Mozilla Firefox, Firefox ESR, Mozilla Thunderbird or Oracle Java SE| ID: oval:org.secpod.oval:def:32565 | Date: (C)2016-01-12 (M)2024-03-27 |
| Class: VULNERABILITY | Family: windows |
The host is installed with Mozilla Firefox before 43.0.2 or Firefox ESR 38.x before 38.5.2, Mozilla Thunderbird 38.x before 38.6, Oracle Java SE through 6u105, through 7u91 or through 8u66 and is prone to a server spoofing vulnerability. A flaw is present in the applications, which fail to handle MD5 signatures in Server Key Exchange messages in TLS 1.2 Handshake Protocol traffic. Successful exploitation allows remote attackers to spoof servers by triggering a collision.
| Platform: |
| Microsoft Windows 11 |
| Microsoft Windows Server 2022 |
| Microsoft Windows Server 2019 |
| Microsoft Windows Server 2016 |
| Microsoft Windows XP |
| Microsoft Windows Server 2003 |
| Microsoft Windows Server 2008 |
| Microsoft Windows Vista |
| Microsoft Windows 7 |
| Microsoft Windows 8 |
| Microsoft Windows 8.1 |
| Microsoft Windows Server 2008 R2 |
| Microsoft Windows Server 2012 |
| Microsoft Windows Server 2012 R2 |
| Microsoft Windows 10 |
| Product: |
| Mozilla Firefox |
| Mozilla Firefox ESR |
| Mozilla Thunderbird |
| Oracle Java JRE |
| Oracle Java JDK |
