CVE:CVE-2015-0799
CNNVD:CNNVD-201504-093
Mozilla Firefox是美国Mozilla基金会开发的一款开源Web浏览器。
Mozilla Firefox 37.0及之前版本的HTTP Alternative Services实现过程中存在安全漏洞。攻击者可借助Alt-Svc HTTP/2响应头的‘uri-host’字段利用该漏洞实施中间人攻击，绕过SSL服务器的既定的X.509证书验证过程。
solution:Upgrade canonical ubuntu_linux to a higher version than 12.04,14.04,14.10,and avoid the version 12.04,14.04,14.10; Upgrade opensuse opensuse to a higher version than 13.1,13.2,and avoid the version 13.1,13.2; Upgrade mozilla firefox to a higher version than 37.0,and avoid the version (,37.0]