CVE:CVE-2015-4498
CNNVD:CNNVD-201508-567
Mozilla Firefox和Firefox ESR都是美国Mozilla基金会开发的浏览器产品。Firefox是一款开源Web浏览器；Firefox ESR是Firefox的一个延长支持版本。
Mozilla Firefox 40.0.3之前版本和Firefox ESR 38.2.1之前38.x版本的add-on installation功能中存在安全漏洞。远程攻击者可通过构建特制的data: URL，并在安装进程初期将其导航到任意http:或https: URL，利用该漏洞绕过既定的user-confirmation要求。
solution:Upgrade mozilla firefox to a higher version than 40.0.2,and avoid the version (,40.0.2]; Upgrade mozilla firefox_esr to a higher version than 38.0,38.0.1,38.0.5,38.1.0,38.2.0,and avoid the version 38.0,38.0.1,38.0.5,38.1.0,38.2.0