Mozilla Firefox is vulnerable to certificate validation bypass. An attacker could first obtain a valid signature for a fraudulent addon, which can be done without review, then hijack the call between the user and AMO to replace the response from /update/VersionCheck.php with the IDs of the fraudulent addon resulting in man-in-the middle attacks.
rhn.redhat.com/errata/RHSA-2016-2780.html
www.securityfocus.com/bid/94336
www.securitytracker.com/id/1037298
access.redhat.com/security/updates/classification/#critical
bugzilla.mozilla.org/show_bug.cgi?id=1303418
rhn.redhat.com/errata/RHSA-2016-2780.html
security.gentoo.org/glsa/201701-15
www.mozilla.org/en-US/security/known-vulnerabilities/firefox-esr/#firefoxesr45.5
www.mozilla.org/security/advisories/mfsa2016-89/
www.mozilla.org/security/advisories/mfsa2016-90/