CVE-2015-0799 — Improper Input Validation in Mozilla Firefox

CWE-20 — Improper Input Validation7 documents6 sources
Severity
4.3MEDIUMNVD
EPSS
0.1%
top 70.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mozilla FirefoxCanonical Ubuntu LinuxOpensuse
Timeline
PublishedApr 8
Latest updateMay 14

Description

The HTTP Alternative Services feature in Mozilla Firefox before 37.0.1 allows man-in-the-middle attackers to bypass an intended X.509 certificate-verification step for an SSL server by specifying that server in the uri-host field of an Alt-Svc HTTP/2 response header.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages3 packages

▶Ubuntumozilla/firefox< 37.0.1+build1-0ubuntu0.14.04.1
▶NVDmozilla/firefox37.0
▶NVDopensuse/opensuse13.1, 13.2+1

Also affects: Ubuntu Linux 12.04, 14.04, 14.10

🔴Vulnerability Details

3
GHSA
GHSA-5mp2-hvxf-rx92: The HTTP Alternative Services feature in Mozilla Firefox before 37↗2022-05-14
▶
OSV
firefox vulnerability↗2015-04-07
▶
OSV
CVE-2015-0799: The HTTP Alternative Services feature in Mozilla Firefox before 37↗2015-04-06
▶

📋Vendor Advisories

2
Ubuntu
Firefox vulnerability↗2015-04-07
▶
Red Hat
Mozilla: Certificate verification bypass through the HTTP/2 Alt-Svc header (MFSA 2015-44)↗2015-04-03
▶

💬Community

1
Bugzilla
CVE-2015-0799 Mozilla: Certificate verification bypass through the HTTP/2 Alt-Svc header (MFSA 2015-44)↗2015-04-03
▶