Untrusted search path vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 on Windows XP allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .htm, .html, .jtx, .mfp, or .eml file.
CVSS Details
- CVSS 3.1 Base Score: 9.6
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade libxulUpgrade firefoxUpgrade linux-firefox-develUpgrade linux-firefoxUpgrade thunderbirdUpgrade seamonkey | Dec 10, 2025 | Sep 8, 2010 |
| Gentoo Linux | — | Upgrade www-client/mozilla-firefox.Upgrade mail-client/mozilla-thunderbird.Upgrade www-client/firefox.Upgrade www-client/icecat.Upgrade dev-libs/nss.Upgrade mail-client/thunderbird-bin.Upgrade www-client/mozilla-firefox-bin.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade net-libs/xulrunner.Upgrade www-client/seamonkey-bin.Upgrade net-libs/xulrunner-bin.Upgrade www-client/seamonkey.Upgrade www-client/firefox-bin.Upgrade mail-client/thunderbird. | Oct 30, 2017 | Aug 26, 2010 |
| Mfsa2010 52 | — | Upgrade to Mozilla Firefox version 3.6.9Upgrade to Mozilla Firefox version 3.5.12 | Jun 14, 2012 | Aug 26, 2010 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.0.7 | Feb 3, 2012 | Aug 26, 2010 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 3.0.7Upgrade to Mozilla Thunderbird version 3.1.3 | Feb 22, 2012 | Aug 26, 2010 |
| Suse | — | Upgrade MozillaFirefox-translationsUpgrade mozilla-nspr-32bitUpgrade mozilla-xulrunner191Upgrade mozilla-nss-32bitUpgrade mozilla-xulrunner190-32bitUpgrade libidl-32bitUpgrade MozillaFirefoxUpgrade mozilla-xulrunner191-x86Upgrade mozilla-xulrunner191-gnomevfsUpgrade mozilla-xulrunner192-gnomeUpgrade mozilla-xulrunner192-32bitUpgrade mozilla-nsprUpgrade mozilla-xulrunner192-translationsUpgrade mozilla-nss-toolsUpgrade libfreebl3-32bitUpgrade mozilla-xulrunner190Upgrade mozilla-nss-x86Upgrade mozilla-nspr-x86Upgrade libidlUpgrade libfreebl3Upgrade mozilla-xulrunner192-x86Upgrade mozilla-xulrunner191-32bitUpgrade MozillaFirefox-branding-SLEDUpgrade orbit2Upgrade libfreebl3-x86Upgrade gconf2Upgrade mozilla-xulrunner190-translationsUpgrade mozilla-xulrunner192Upgrade mozilla-nssUpgrade gconf2-32bitUpgrade libidl-x86Upgrade orbit2-32bitUpgrade gconf2-x86Upgrade mozilla-xulrunner191-translationsUpgrade mozilla-xulrunner190-x86Upgrade mozilla-xulrunner190-gnomevfsUpgrade orbit2-x86 | Feb 17, 2015 | Jul 9, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub