When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%.<br>*This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade firefox-esrUpgrade firefoxUpgrade thunderbirdUpgrade librewolf | Aug 22, 2024 | Dec 22, 2022 |
| Mfsa2022 20 | — | Upgrade to Mozilla Firefox version 101.0Upgrade to the latest version of Mozilla Firefox | Jun 1, 2022 | May 31, 2022 |
| Mfsa2022 21 | — | Upgrade to the latest version of Mozilla FirefoxUpgrade to Mozilla Firefox ESR version 91.10 | Jun 1, 2022 | May 31, 2022 |
| Mozilla Thunderbird | — | Upgrade to the latest version of Mozilla ThunderbirdUpgrade to Mozilla Thunderbird version 91.10 | Jun 1, 2022 | May 31, 2022 |
| Suse | — | Upgrade mozillafirefox-branding-upstreamUpgrade MozillaThunderbird-translations-commonUpgrade MozillaFirefox-translations-commonUpgrade MozillaThunderbirdUpgrade MozillaFirefoxUpgrade MozillaFirefox-develUpgrade MozillaFirefox-translations-otherUpgrade MozillaThunderbird-translations-other | Oct 26, 2022 | Jun 2, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub