Mozilla Firefox before 20.0 on Android uses world-writable and world-readable permissions for the app_tmp installation directory in the local filesystem, which allows attackers to modify add-ons before installation via an application that leverages the time window during which app_tmp is used.
CVSS Details
- CVSS 3.1 Base Score: 6.2
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade seamonkeyUpgrade linux-seamonkeyUpgrade thunderbirdUpgrade linux-thunderbirdUpgrade linux-firefoxUpgrade firefox | Dec 10, 2025 | Apr 3, 2013 |
| Mfsa2013 33 | — | — | Apr 3, 2013 | Apr 2, 2013 |
| Suse | — | Upgrade mozilla-nss-develUpgrade MozillaFirefoxUpgrade sle-sdk-releaseUpgrade mozilla-nspr-develUpgrade mozilla-nss-x86Upgrade mozilla-nss-32bitUpgrade mozilla-nss-toolsUpgrade mozilla-nspr-x86Upgrade libfreebl3-x86Upgrade MozillaFirefox-branding-SLEDUpgrade mozilla-nspr-32bitUpgrade mozilla-nss-64bitUpgrade mozillafirefox-branding-upstreamUpgrade MozillaFirefox-translationsUpgrade libfreebl3-32bitUpgrade libfreebl3Upgrade mozilla-nspr-64bitUpgrade mozilla-nssUpgrade mozilla-nspr | Feb 17, 2015 | Apr 3, 2013 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub