# MA-468.042015: MyCERT Advisory - Mozilla Releases Security Update for Firefox

**Date:** 10 Apr 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-468.042015  
**Advisory ID:** MA-468.042015

---

#### **1.0 Introduction** The Mozilla Foundation has released Firefox 37.0.1 to address two vulnerabilities, one of which may allow a remote attacker to conduct man-in-the-middle attacks. Mozilla encourages users and administrators to review Mozilla's Security Updates and apply the necessary updates.
**2.0 Impact**
The vulnerabilities impacting each software are listed below:
**Firefox**
- **Certificate verification bypass through the HTTP/2 Alt-Svc header –**
If an Alt-Svc header is specified in the HTTP/2 response, SSL certificate verification can be bypassed for the specified alternate server. As a result of this, warnings of invalid SSL certificates will not be displayed and an attacker could potentially impersonate another site through a man-in-the-middle (MTIM), replacing the original certificate with their own.
- **Loading privileged content through Reader mode** –
a flaw in Reader mode on Firefox for Android. Reader mode reformats web content for easy readability and operates as unprivileged content that is the equivalent of the formatted content. When Reader mode is unable to process content, it displays the original web pages. Since it is unprivileged, there are no restrictions on pages linking to or framing Reader mode content. The reported flaw is that privileged URLs can be passed to Reader mode and bypass the normal restrictions that prevent web pages from obtaining references to privileged contexts. If this issue was combined with another flaw that allowed for a violation of the same-origin policy, then the resulting combination could lead to arbitrary code execution.
**3.0 Affected Product**
The detail lists of the Mozilla products updates are as below:
- Firefox
**4.0 Recommendation**
MyCERT highly recommended users of these applications to upgrade to the latest version of the affected products. The following updates are available:
**4.1 Mozilla Firefox**
Advisories:
<https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox/>
Download:
<https://www.mozilla.org/en-GB/firefox/new/>
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection#95f6ecf7f0e7acacacd5f6ecf7f0e7e6f0f6e0e7fce1ecbbf8ec) or [[email protected]](/cdn-cgi/l/email-protection#abc6d2c8ced9dfebc6d2c8ced9df85c4d9cc85c6d2) 
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- US-CERT: Mozilla Releases Security Updates for Firefox, <https://www.us-cert.gov/ncas/current-activity/2015/04/06/Mozilla-Releases-Security-Update-Firefox>
- Security Advisories for Firefox, [https://www.mozilla.org/en-U S/security/known-vulnerabilities/firefox](https://www.mozilla.org/en-US/security/known-vulnerabilities/firefox)