CVE-2015-2741: Medium severity firefox vulnerability
Last updated 24 July 2024
Other sources
Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 do not enforce key pinning upon encountering an X.509 certificate problem that generates a user dialog, which allows user-assisted man-in-the-middle attackers to bypass intended access restrictions by triggering a (1) expired certificate or (2) mismatched hostname for a domain with pinning enabled.
— Launchpad
Affected Software
Event History
Frequently Asked Questions
What is CVE-2015-2741?
CVE-2015-2741 is a vulnerability in Mozilla Firefox, Firefox ESR, and Thunderbird that allows user-assisted man-in-the-middle attackers to bypass access restrictions.
What is the severity of CVE-2015-2741?
The severity of CVE-2015-2741 is medium with a CVSS score of 4.3.
How does CVE-2015-2741 work?
CVE-2015-2741 allows attackers to bypass key pinning by triggering a user dialog with an X.509 certificate problem.
How can I fix CVE-2015-2741?
To fix CVE-2015-2741, update Mozilla Firefox to version 39.0 or later, or update Thunderbird to version 31.8 or later.
Where can I find more information about CVE-2015-2741?
More information about CVE-2015-2741 can be found on the MITRE CVE website and the Mozilla security advisories.