Untrusted search path vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 on Windows XP allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .htm, .html, .jtx, .mfp, or .eml file.
CVSS Details
- CVSS 3.1 Base Score: 9.6
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade linux-firefoxUpgrade firefoxUpgrade linux-firefox-develUpgrade seamonkeyUpgrade thunderbirdUpgrade libxul | Dec 10, 2025 | Sep 8, 2010 |
| Gentoo Linux | — | Upgrade www-client/icecat.Upgrade mail-client/thunderbird-bin.Upgrade dev-libs/nss.Upgrade mail-client/mozilla-thunderbird.Upgrade www-client/firefox.Upgrade www-client/mozilla-firefox-bin.Upgrade mail-client/mozilla-thunderbird-bin.Upgrade net-libs/xulrunner.Upgrade www-client/mozilla-firefox.Upgrade www-client/firefox-bin.Upgrade net-libs/xulrunner-bin.Upgrade www-client/seamonkey.Upgrade mail-client/thunderbird.Upgrade www-client/seamonkey-bin. | Oct 30, 2017 | Aug 26, 2010 |
| Mfsa2010 52 | — | Upgrade to Mozilla Firefox version 3.5.12Upgrade to Mozilla Firefox version 3.6.9 | Jun 14, 2012 | Aug 26, 2010 |
| Mozilla Seamonkey | — | Upgrade to Mozilla SeaMonkey version 2.0.7 | Feb 3, 2012 | Aug 26, 2010 |
| Mozilla Thunderbird | — | Upgrade to Mozilla Thunderbird version 3.0.7Upgrade to Mozilla Thunderbird version 3.1.3 | Feb 22, 2012 | Aug 26, 2010 |
| Suse | — | Upgrade gconf2-x86Upgrade gconf2-32bitUpgrade mozilla-xulrunner192-x86Upgrade mozilla-xulrunner191-translationsUpgrade mozilla-xulrunner190-x86Upgrade orbit2-32bitUpgrade orbit2Upgrade libfreebl3Upgrade libfreebl3-x86Upgrade mozilla-xulrunner190-gnomevfsUpgrade mozilla-nssUpgrade orbit2-x86Upgrade libidl-x86Upgrade mozilla-xulrunner191-32bitUpgrade mozilla-xulrunner190-translationsUpgrade gconf2Upgrade MozillaFirefox-branding-SLEDUpgrade mozilla-xulrunner192Upgrade mozilla-xulrunner191-x86Upgrade mozilla-xulrunner192-gnomeUpgrade libfreebl3-32bitUpgrade libidlUpgrade MozillaFirefox-translationsUpgrade MozillaFirefoxUpgrade mozilla-nspr-x86Upgrade mozilla-xulrunner191Upgrade mozilla-xulrunner192-translationsUpgrade mozilla-xulrunner191-gnomevfsUpgrade mozilla-xulrunner192-32bitUpgrade mozilla-nss-32bitUpgrade mozilla-nss-x86Upgrade mozilla-nss-toolsUpgrade mozilla-nspr-32bitUpgrade mozilla-xulrunner190-32bitUpgrade mozilla-xulrunner190Upgrade mozilla-nsprUpgrade libidl-32bit | Feb 17, 2015 | Jul 9, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub