Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 573
Alerts This Week
Warning Icon 1 573

Ubuntu 14.10: 2557-1 Critical: Firefox SSL Bypass Attack

ubuntu
Calendar Grey April 7, 2015
Dist Ubuntu Esm H88
Ubuntu's Firefox may override SSL certificate verifications because of a vulnerability, exposing users to potential man-in-the-middle threats. Ensure you upgrade immediately!
Firefox could be made to bypass SSL certificate verification.

Summary

Firefox could be made to bypass SSL certificate verification.

Software Description:

- firefox: Mozilla Open Source web browser

Details:

Muneaki Nishimura discovered a flaw in Mozilla's HTTP Alternative Services

implementation which meant SSL certificate verification could be bypassed

in some circumstances. A remote attacker could potentially exploit this to

conduct a man in the middle attack. (CVE-2015-0799)

Topics%20covered

Topics Covered

security advisory critical Ubuntu Firefox SSL bypass

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  firefox                         37.0.1+build1-0ubuntu0.14.10.1

Ubuntu 14.04 LTS:
  firefox                         37.0.1+build1-0ubuntu0.14.04.1

Ubuntu 12.04 LTS:
  firefox                         37.0.1+build1-0ubuntu0.12.04.1

After a standard system update you need to restart Firefox to make
all the necessary changes.

References

https://ubuntu.com/security/notices/USN-2557-1

CVE-2015-0799

Severity
critical
Lowest
Low
Medium
High
Critical

April 07, 2015

Topics%20covered

Topics Covered

security advisory critical Ubuntu Firefox SSL bypass

Package Information

https://launchpad.net/ubuntu/+source/firefox/37.0.1+build1-0ubuntu0.14.10.1
https://launchpad.net/ubuntu/+source/firefox/37.0.1+build1-0ubuntu0.14.04.1
https://launchpad.net/ubuntu/+source/firefox/37.0.1+build1-0ubuntu0.12.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.