Every CVE Search/ Get API key

CVE-2015-5244

The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote...

9.8 Critical

The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.75%Up 1.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.8

The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.

Record
CVE-2015-5244
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.

Record
CVE-2015-5244
Updated
2026-11-02
EUVDEUVD-2015-5236 No score

The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.

Record
EUVD-2015-5236
Updated
2026-11-03
GitHub AdvisoriesGHSA-f93f-jh28-5ffr 9.8

The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote...

The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.

Record
GHSA-f93f-jh28-5ffr
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2015-5244 9.8

The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.

Record
UBUNTU-CVE-2015-5244
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:10311-1 No score

apache2-mod_nss-1.0.14-4.1 on GA media

These are all security issues fixed in the apache2-mod_nss-1.0.14-4.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10311-1
Updated
2026-11-02
OSVSUSE-SU-2016:2285-1 No score

Security update for apache2-mod_nss

This update provides apache2-mod_nss 1.0.14, which brings several fixes and enhancements:

  • Fix OpenSSL ciphers stopped parsing at +. (CVE-2016-3099)
  • Created valgrind suppression files to ease debugging.
  • Implement SSL_PPTYPE_FILTER to call executables to get the key password pins.
  • Improvements to migrate.pl.
  • Update default ciphers to something more modern and secure.
  • Check for host and netstat commands in gencert before trying to use them.
  • Add server support for DHE ciphers.
  • Extract SAN from server/client certificates into env
  • Fix memory leaks and other coding issues caught by clang analyzer.
  • Add support for Server Name Indication (SNI).
  • Add support for SNI for reverse proxy connections.
  • Add RenegBufferSize? option.
  • Add support for TLS Session Tickets (RFC 5077).
  • Fix logical AND support in OpenSSL cipher compatibility.
  • Correctly handle disabled ciphers. (CVE-2015-5244)
  • Implement a slew more OpenSSL cipher macros.
  • Fix a number of illegal memory accesses and memory leaks.
  • Support for SHA384 ciphers if they are available in NSS.
  • Add compatibility for mod_ssl-style cipher definitions.
  • Add TLSv1.2-specific ciphers.
  • Completely remove support for SSLv2.
  • Add support for sqlite NSS databases.
  • Compare subject CN and VS hostname during server start up.
  • Add support for enabling TLS v1.2.
  • Don't enable SSL 3 by default. (CVE-2014-3566)
  • Fix CVE-2013-4566.
  • Move nss_pcache to /usr/libexec.
  • Support httpd 2.4+.
  • Use apache2-systemd-ask-pass to prompt for a certificate passphrase. (bsc#972968, bsc#975394)
Record
SUSE-SU-2016:2285-1
Updated
2026-11-02
OSVSUSE-SU-2016:2396-1 No score

Security update for apache2-mod_nss

This update provides apache2-mod_nss 1.0.14, which brings several fixes and enhancements:

  • Fix OpenSSL ciphers stopped parsing at +. (CVE-2016-3099)
  • Created valgrind suppression files to ease debugging.
  • Implement SSL_PPTYPE_FILTER to call executables to get the key password pins.
  • Improvements to migrate.pl.
  • Update default ciphers to something more modern and secure.
  • Check for host and netstat commands in gencert before trying to use them.
  • Add server support for DHE ciphers.
  • Extract SAN from server/client certificates into env
  • Fix memory leaks and other coding issues caught by clang analyzer.
  • Add support for Server Name Indication (SNI).
  • Add support for SNI for reverse proxy connections.
  • Add RenegBufferSize? option.
  • Add support for TLS Session Tickets (RFC 5077).
  • Fix logical AND support in OpenSSL cipher compatibility.
  • Correctly handle disabled ciphers. (CVE-2015-5244)
  • Implement a slew more OpenSSL cipher macros.
  • Fix a number of illegal memory accesses and memory leaks.
  • Support for SHA384 ciphers if they are available in NSS.
  • Add compatibility for mod_ssl-style cipher definitions.
  • Add TLSv1.2-specific ciphers.
  • Completely remove support for SSLv2.
  • Add support for sqlite NSS databases.
  • Compare subject CN and VS hostname during server start up.
  • Add support for enabling TLS v1.2.
  • Don't enable SSL 3 by default. (CVE-2014-3566)
  • Fix CVE-2013-4566.
  • Move nss_pcache to /usr/libexec.
  • Support httpd 2.4+.
  • SHA256 cipher names change spelling from *_sha256 to *_sha_256.
  • Use apache2-systemd-ask-pass to prompt for a certificate passphrase. (bsc#972968, bsc#975394)
Record
SUSE-SU-2016:2396-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache2-mod_nss
SUSE:Linux Enterprise Server 12 SP1
From an advisory covering 4 CVEs
 before 1.0.14-18.3
1.0.14-18.3
apache2-mod_nss
SUSE:Linux Enterprise Server for SAP Applications 12 SP1
From an advisory covering 4 CVEs
 before 1.0.14-18.3
1.0.14-18.3
apache2-mod_nss
SUSE:Linux Enterprise Server for SAP Applications 12
From an advisory covering 4 CVEs
 before 1.0.14-10.14.3
1.0.14-10.14.3
apache2-mod_nss
SUSE:Linux Enterprise Server 12-LTSS
From an advisory covering 4 CVEs
 before 1.0.14-10.14.3
1.0.14-10.14.3
apache2-mod_nss
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 1.0.14-4.1
1.0.14-4.1

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-5244 is a critical vulnerability (CVSS 9.8) in Mod Nss Project Nss, published September 10, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.75%, the 86th percentile. No source names a fixed version.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open