PT-2016-2199 · Mozilla · Firefox Esr+1

Frédéric Hoguin · Publicado 2016-06-07 · Atualizado 2024-10-22 · CVE-2016-2826

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 47.0 Mozilla Firefox ESR versions prior to 45.2

Description The issue is related to the maintenance service in Mozilla Firefox, which does not properly prevent modification of extracted files during the execution of the updater. This might allow local users to gain privileges via a Trojan horse file. The vulnerability is associated with insufficient access control, which can be exploited by a local attacker to elevate their privileges using a malicious file.

Recommendations For Mozilla Firefox versions prior to 47.0, update to version 47.0 or later. For Mozilla Firefox ESR versions prior to 45.2, update to version 45.2 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2016-01552

CVE-2016-2826

Produtos afetados

Firefox

Firefox Esr

Referências · 7

• http://mozilla.org/security/announce/2016/mfsa2016-55.html · Aviso do Fabricante
• http://securityfocus.com/bid/91075 · Nota
• http://securitytracker.com/id/1036057 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-2826 · Nota de Segurança
• https://bugzilla.mozilla.org/show_bug.cgi?id=1237219 · Nota
• https://bdu.fstec.ru/vul/2016-01552 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-2826 · Aviso do Fabricante