QSearchQSearch

CVE-2015-2808

3.7 LOW

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initializa...

Published: 2015-04-01 · Last updated: 2026-05-28

Severity and scoring

CVSS
3.7 LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE
CWE-327

Affected products

VendorProduct
canonical9700_firmware, cognos_metrics_manager, communications_application_session_controller
debian9700_firmware, cognos_metrics_manager, communications_application_session_controller
fujitsu9700_firmware, cognos_metrics_manager, communications_application_session_controller
huawei9700_firmware, cognos_metrics_manager, communications_application_session_controller
ibm9700_firmware, cognos_metrics_manager, communications_application_session_controller
opensuse9700_firmware, cognos_metrics_manager, communications_application_session_controller
oracle9700_firmware, cognos_metrics_manager, communications_application_session_controller
redhat9700_firmware, cognos_metrics_manager, communications_application_session_controller
suse9700_firmware, cognos_metrics_manager, communications_application_session_controller

Description

The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.

Source: NVD

References

Related CVEs

Same vendor

  • CVE-2026-49975 — Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP ... (7.5 HIGH)
  • CVE-2026-50259 — A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland (7.8 HIGH)
  • CVE-2026-50258 — A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland (7.8 HIGH)
  • CVE-2026-50257 — A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence() (7.8 HIGH)
  • CVE-2026-50256 — A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland (7.8 HIGH)

Same CWE

  • CVE-2025-10237 — During an internal security assessment, a potential vulnerability was discovered in some ThinkPad embedded controller firmware that could... (6.7 MEDIUM)
  • CVE-2026-11481 — A vulnerability was determined in yoanbernabeu grepai up to 0.35.0 (2.5 LOW)
  • CVE-2026-11479 — A vulnerability has been found in yoanbernabeu grepai 0.35.0 (4.2 MEDIUM)
  • CVE-2026-46395 — HAX CMS helps manage microsite universe with PHP or NodeJs backends
  • CVE-2026-11330 — A weakness has been identified in thedotmack claude-mem up to 11.0.1 (3.6 LOW)