Attack on security model for RSA-FDH I recently read in Cryptography textbooks and online videos that compared to Textbook RSA which is insecure against Chosen
Plaintext Attacks (CPA) and Chosen Ciphertext Attacks (CCA), RSA-FDH is Existentially Unforgeable Under Chosen Message Attacks
(EUF-CMA) if the hash fuction is uniformly random. 

However, to my surprise, on online Cryptography forums and some Cryptographers say that the security model behind RSA-FDH, so EUF-CMA
can be broken if one can find collisions in the hash function itself. The thing is, I have not been able to find such examples or even
understand how this is even possible. I read in a lecture slide online that if we ask signatures $σ_1$, $σ_2$ for $m_1,m_2 \in \mathbb{Z}_n^*$ and 
output $(m^*, σ^*) := (m_1 \cdot m_2 \mod{(N)},\ σ_1 \cdot  σ_2 \mod{(N)})$. But then I still don't know how it practically applies to RSA-FDH IF the hash function has collisions.
This is 
a) no attack on the security model, but an attack in the security model of EUF-CMA, and
b) a generic attack on any signature scheme that signs the hash of a message instead of the message itself (as done in RSA-FDH).     

The idea is that if you can find a collision for the used hash function $H$, i.e., two messages $m_1, m_2$ such that $H(m_1) = H(m_2)$, then they have the same signature: $\sigma = \textrm{sign}(sk,m_1) = \textrm{sign}(sk,m_2)$.
To see this consider RSA-FDH as example: The signature on $m_1$ is $\textrm{sign}(sk,m_1) = (H(m_1))^d \mod N$ for private exponent $d$ and modulo $N$. The signature on $m_2$ is $\textrm{sign}(sk,m_2) = (H(m_2))^d \mod N = (H(m_1))^d \mod N = \textrm{sign}(sk,m_1),$ where the mid equality follows from $m_1,m_2$ being a collision.

In the EUF-CMA setting you are allowed to ask for signatures on arbitrary messages and have to come up with a signature on a new message. So given collision $m_1,m_2$, you ask for a signature $\sigma$ on $m_1$ and then output the pair $(m_2, \sigma)$ as forgery.