Certificates and code signatures that relied on MD5 or SHA-1 fingerprints.
The idea: A signature only covers the fingerprint. The 2008 attack prepared two certificates with the same MD5 fingerprint: an ordinary website certificate, and one saying "this is a certificate authority". The real authority signed the first. The signature was just as valid on the second, which let the attackers issue certificates for any site.
Why it matters: Attackers used MD5 collisions to make a fake certificate authority (2008) and to sign malware as Microsoft (2012).
The details
On the map: ✗ rogue CA (2008), Flame malware signed as Microsoft (2012)
Signatures sign a hash of the document, so a collision means one signature covers two documents.
In 2008 researchers (Sotirov, Stevens and colleagues)[1] got a real certificate authority to sign an innocent-looking MD5 certificate whose hash collided with a second certificate that made them a certificate authority themselves, trusted by every browser.
In 2012 the Flame espionage malware used a new chosen-prefix MD5 collision to forge a Microsoft code-signing certificate[2, 3] and spread through fake Windows updates.
That is why the map tags hash-then-sign schemes CRH: their security depends on the hash's collision resistance.
Nothing on the map depends on it: it is an end point, something people use directly.
References
Marc Stevens, Alexander Sotirov, Jacob Appelbaum et al. Short Chosen-Prefix Collisions for MD5 and the Creation of a Rogue CA Certificate. Advances in Cryptology - CRYPTO 2009. doi:10.1007/978-3-642-03356-8_4