A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code.
*This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade firefox-esrUpgrade firefoxUpgrade thunderbird | Aug 22, 2024 | Jun 19, 2023 |
| Mfsa2023 13 | — | Upgrade to Mozilla Firefox version 112.0Upgrade to the latest version of Mozilla Firefox | Apr 12, 2023 | Apr 11, 2023 |
| Mfsa2023 14 | — | Upgrade to Mozilla Firefox ESR version 102.10Upgrade to the latest version of Mozilla Firefox | Apr 12, 2023 | Apr 11, 2023 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 102.10Upgrade to the latest version of Mozilla Thunderbird | Apr 12, 2023 | Apr 11, 2023 |
| Suse | — | Upgrade MozillaFirefox-translations-commonUpgrade MozillaThunderbird-translations-commonUpgrade mozillafirefox-branding-upstreamUpgrade MozillaFirefox-develUpgrade MozillaFirefox-translations-otherUpgrade MozillaThunderbird-translations-otherUpgrade MozillaThunderbirdUpgrade MozillaFirefox | Apr 12, 2023 | Apr 11, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub