{"id":"CVE-2015-5244","aliases":["EUVD-2015-5236","GHSA-f93f-jh28-5ffr","SUSE-SU-2016:2285-1","SUSE-SU-2016:2396-1","UBUNTU-CVE-2015-5244","openSUSE-SU-2024:10311-1"],"status":"published","title":"The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote...","description":"The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02749,"percentile":0.86288,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-264"],"published":"2016-09-10T10:52:38Z","modified":"2026-06-17T00:28:44Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"apache2-mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-18.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"apache2-mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-18.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"apache2-mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-10.14.3"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"apache2-mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-10.14.3"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache2-mod_nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.14-4.1"}]}],"bundled":4}],"products":[{"vendor":"mod_nss_project","product":"mod_nss"}],"references":[{"url":"https://pagure.io/mod_nss/c/34e1ccecb4a7d5054dba2f92b403af9b6ae1e110","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-January/175248.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176026.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1259216","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-5244"},{"url":"https://github.com/advisories/GHSA-f93f-jh28-5ffr"},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162285-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/972968","tags":["report"]},{"url":"https://bugzilla.suse.com/975394","tags":["report"]},{"url":"https://bugzilla.suse.com/979688","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3099","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162396-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2015-5244","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-5244","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2015-5244","description":"The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.","status":"published","published":"2017-08-07T20:00:00Z","modified":"2024-08-06T06:41:08.45Z","updated_at":"2026-11-02T14:35:39.846011Z"}],"euvd":[{"id":"EUVD-2015-5236","description":"The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.","status":"published","published":"2017-08-07T20:00:00Z","modified":"2024-08-06T06:41:08Z","updated_at":"2026-11-03T02:22:00.863884Z"}],"ghsa":[{"id":"GHSA-f93f-jh28-5ffr","title":"The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote...","description":"The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.","status":"published","published":"2022-05-17T02:12:13Z","modified":"2023-01-27T05:03:52Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:42:20.442744Z"}],"nvd":[{"id":"CVE-2015-5244","description":"The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.","status":"published","published":"2017-08-07T20:29:00.45Z","modified":"2026-06-17T00:28:44.77Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:03:17.730372Z"}],"osv":[{"id":"UBUNTU-CVE-2015-5244","description":"The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions.","status":"withdrawn","published":"2017-08-07T20:29:00Z","modified":"2025-07-16T07:33:08.508909Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:10.385269Z"},{"id":"openSUSE-SU-2024:10311-1","title":"apache2-mod_nss-1.0.14-4.1 on GA media","description":"These are all security issues fixed in the apache2-mod_nss-1.0.14-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:15:00.342661Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2016:2285-1","title":"Security update for apache2-mod_nss","description":"\nThis update provides apache2-mod_nss 1.0.14, which brings several fixes and\nenhancements:\n\n- Fix OpenSSL ciphers stopped parsing at +. (CVE-2016-3099)\n- Created valgrind suppression files to ease debugging.\n- Implement SSL_PPTYPE_FILTER to call executables to get the key password pins.\n- Improvements to migrate.pl.\n- Update default ciphers to something more modern and secure.\n- Check for host and netstat commands in gencert before trying to use them.\n- Add server support for DHE ciphers.\n- Extract SAN from server/client certificates into env\n- Fix memory leaks and other coding issues caught by clang analyzer.\n- Add support for Server Name Indication (SNI).\n- Add support for SNI for reverse proxy connections.\n- Add RenegBufferSize? option.\n- Add support for TLS Session Tickets (RFC 5077).\n- Fix logical AND support in OpenSSL cipher compatibility.\n- Correctly handle disabled ciphers. (CVE-2015-5244)\n- Implement a slew more OpenSSL cipher macros.\n- Fix a number of illegal memory accesses and memory leaks.\n- Support for SHA384 ciphers if they are available in NSS.\n- Add compatibility for mod_ssl-style cipher definitions.\n- Add TLSv1.2-specific ciphers.\n- Completely remove support for SSLv2.\n- Add support for sqlite NSS databases.\n- Compare subject CN and VS hostname during server start up.\n- Add support for enabling TLS v1.2.\n- Don't enable SSL 3 by default. (CVE-2014-3566)\n- Fix CVE-2013-4566.\n- Move nss_pcache to /usr/libexec.\n- Support httpd 2.4+.\n- Use apache2-systemd-ask-pass to prompt for a certificate passphrase.\n  (bsc#972968, bsc#975394)\n","status":"published","published":"2016-09-10T10:52:38Z","modified":"2025-05-02T04:03:59.36217Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:2396-1","title":"Security update for apache2-mod_nss","description":"\nThis update provides apache2-mod_nss 1.0.14, which brings several fixes and\nenhancements:\n\n- Fix OpenSSL ciphers stopped parsing at +. (CVE-2016-3099)\n- Created valgrind suppression files to ease debugging.\n- Implement SSL_PPTYPE_FILTER to call executables to get the key password pins.\n- Improvements to migrate.pl.\n- Update default ciphers to something more modern and secure.\n- Check for host and netstat commands in gencert before trying to use them.\n- Add server support for DHE ciphers.\n- Extract SAN from server/client certificates into env\n- Fix memory leaks and other coding issues caught by clang analyzer.\n- Add support for Server Name Indication (SNI).\n- Add support for SNI for reverse proxy connections.\n- Add RenegBufferSize? option.\n- Add support for TLS Session Tickets (RFC 5077).\n- Fix logical AND support in OpenSSL cipher compatibility.\n- Correctly handle disabled ciphers. (CVE-2015-5244)\n- Implement a slew more OpenSSL cipher macros.\n- Fix a number of illegal memory accesses and memory leaks.\n- Support for SHA384 ciphers if they are available in NSS.\n- Add compatibility for mod_ssl-style cipher definitions.\n- Add TLSv1.2-specific ciphers.\n- Completely remove support for SSLv2.\n- Add support for sqlite NSS databases.\n- Compare subject CN and VS hostname during server start up.\n- Add support for enabling TLS v1.2.\n- Don't enable SSL 3 by default. (CVE-2014-3566)\n- Fix CVE-2013-4566.\n- Move nss_pcache to /usr/libexec.\n- Support httpd 2.4+.\n- SHA256 cipher names change spelling from *_sha256 to *_sha_256.\n- Use apache2-systemd-ask-pass to prompt for a certificate passphrase.\n  (bsc#972968, bsc#975394)\n","status":"published","published":"2016-09-27T13:12:22Z","modified":"2026-02-04T03:13:59.192251Z","updated_at":"2026-11-02T15:53:43.438985Z"}]}}