Mozilla Firefox before 37.0 does not require an HTTPS session for lightweight theme add-on installations, which allows man-in-the-middle attackers to bypass an intended user-confirmation requirement by deploying a crafted web site and conducting a DNS spoofing attack against a mozilla.org subdomain.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Firefox | Mozilla | 36.0.4 (including) | 36.0.4 (including) |