The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | freebsd-upgrade-package-firefoxfreebsd-upgrade-package-seamonkeyfreebsd-upgrade-package-linux-seamonkeyfreebsd-upgrade-package-firefox-esrfreebsd-upgrade-package-linux-firefoxfreebsd-upgrade-package-libxulfreebsd-upgrade-package-thunderbirdfreebsd-upgrade-package-linux-thunderbird | Nov 16, 2016 | Nov 16, 2016 | |
| Gentoo Linux | gentoo-linux-upgrade-mail-client-thunderbirdgentoo-linux-upgrade-mail-client-thunderbird-bingentoo-linux-upgrade-www-client-firefoxgentoo-linux-upgrade-www-client-firefox-bin | Oct 30, 2017 | Jan 3, 2017 | |
| Mfsa2016 89 | mozilla-firefox-upgrade-50_0 | Jul 12, 2018 | Jun 11, 2018 | |
| Mfsa2016 90 | mozilla-firefox-esr-upgrade-45_5 | Nov 16, 2016 | Nov 15, 2016 | |
| Mozilla Thunderbird | mozilla-thunderbird-upgrade-45_5 | Dec 1, 2016 | Nov 18, 2016 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-mail-thunderbird-45-5-1-0-175-3-16-0-2-0oracle-solaris-11-3-upgrade-mail-thunderbird-plugin-thunderbird-lightning-45-5-1-0-175-3-16-0-2-0 | May 29, 2017 | May 29, 2017 | |
| Suse | — | suse-upgrade-mozillafirefoxsuse-upgrade-mozillafirefox-develsuse-upgrade-mozillafirefox-translations-commonsuse-upgrade-mozillafirefox-translations-other | Dec 5, 2016 | Nov 15, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub