Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.3

Firefox and Thunderbird allow man‑in‑the‑middle via certificate warnings

CVE-2015-2741 · published 11 years ago
Summary

Older versions of Firefox (before 39), Firefox ESR (before 38.1) and Thunderbird (before 38.1) may let an attacker intercept traffic when a certificate error shows a prompt. Because the browsers do not enforce their built‑in certificate safety checks in this case, a user could be tricked into accepting a fake or expired certificate and expose data. Upgrade to the latest browser and email client releases to restore full protection.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
mozilla firefox <= 38.1.0
31.0
31.1.0
31.1.1
31.3.0
31.5.1
31.5.2
31.5.3
38.0
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
oracle solaris 11.3
cpe:2.3:o:oracle:solaris:11.3:*:*:*:*:*:*:*
mozilla firefox_esr 31.1
31.2
31.3
31.4
31.5
31.6.0
31.7.0
cpe:2.3:a:mozilla:firefox_esr:31.1:*:*:*:*:*:*:*
Original advisory text
Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 do not enforce key pinning upon encountering an X.509 certificate problem that generates a user dialog, which ...
Mozilla Firefox before 39.0, Firefox ESR 38.x before 38.1, and Thunderbird before 38.1 do not enforce key pinning upon encountering an X.509 certificate problem that generates a user dialog, which allows user-assisted man-in-the-middle attackers to bypass intended access restrictions by triggering a (1) expired certificate or (2) mismatched hostname for a domain with pinning enabled.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.3 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-310Cryptographic Issues
Timeline
Published6 Jul 2015
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2015-2741 · NVD
Track software like this
Free during beta