Untrusted search path vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 on Windows XP allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .htm, .html, .jtx, .mfp, or .eml file.
CVSS Details
- CVSS 3.1 Base Score: 9.6
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade libxulUpgrade seamonkeyUpgrade linux-firefox-develUpgrade firefoxUpgrade linux-firefoxUpgrade thunderbird | Dec 10, 2025 | Sep 8, 2010 |
| Gentoo Linux | — | Upgrade www-client/seamonkey.Upgrade net-libs/xulrunner-bin.Upgrade www-client/firefox-bin.Upgrade www-client/seamonkey-bin.Upgrade mail-client/thunderbird.Upgrade net-libs/xulrunner.Upgrade www-client/icecat.Upgrade www-client/firefox.Upgrade www-client/mozilla-firefox-bin.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade www-client/mozilla-firefox.Upgrade dev-libs/nss.Upgrade mail-client/thunderbird-bin.Upgrade mail-client/mozilla-thunderbird. | Oct 30, 2017 | Aug 26, 2010 |
| Mfsa2010 52 | — | Upgrade to Mozilla Firefox version 3.5.12Upgrade to Mozilla Firefox version 3.6.9 | Jun 14, 2012 | Aug 26, 2010 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.0.7 | Feb 3, 2012 | Aug 26, 2010 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 3.0.7Upgrade to Mozilla Thunderbird version 3.1.3 | Feb 22, 2012 | Aug 26, 2010 |
| Suse | — | Upgrade mozilla-xulrunner192-32bitUpgrade mozilla-nspr-x86Upgrade mozilla-xulrunner190-32bitUpgrade mozilla-nspr-32bitUpgrade mozilla-nss-x86Upgrade mozilla-xulrunner190Upgrade mozilla-nss-32bitUpgrade mozilla-nsprUpgrade libfreebl3-32bitUpgrade MozillaFirefoxUpgrade mozilla-xulrunner192-gnomeUpgrade mozilla-xulrunner191-x86Upgrade MozillaFirefox-translationsUpgrade mozilla-xulrunner191-gnomevfsUpgrade libidlUpgrade libidl-32bitUpgrade mozilla-nss-toolsUpgrade mozilla-xulrunner191Upgrade mozilla-xulrunner192-translationsUpgrade gconf2-x86Upgrade mozilla-xulrunner190-gnomevfsUpgrade orbit2-x86Upgrade mozilla-xulrunner190-x86Upgrade MozillaFirefox-branding-SLEDUpgrade gconf2Upgrade mozilla-xulrunner190-translationsUpgrade mozilla-nssUpgrade libidl-x86Upgrade orbit2-32bitUpgrade orbit2Upgrade libfreebl3Upgrade mozilla-xulrunner192Upgrade mozilla-xulrunner191-32bitUpgrade libfreebl3-x86Upgrade gconf2-32bitUpgrade mozilla-xulrunner191-translationsUpgrade mozilla-xulrunner192-x86 | Feb 17, 2015 | Jul 9, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub