PT-2016-2530 · Mozilla+1 · Firefox+1

Holger Fuhrmannek

·

Publicado

2016-08-02

·

Atualizado

2024-12-12

·

CVE-2016-5253

CVSS v3.1

4.7

Média

VetorAV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 48.0
Description The issue is related to the Updater component in Mozilla Firefox, which allows local users to write to arbitrary files. This is achieved through vectors involving the application-path parameter and a hard link. The vulnerability is associated with insufficient access control, enabling a local attacker to modify arbitrary files by exploiting the parameter and hard link.
Recommendations For versions prior to 48.0, update to version 48.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Updater component until a patch is available. Avoid using the application-path parameter in sensitive operations until the issue is resolved.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2016-1836
ALT-PU-2017-1578
BDU:2016-01921
CVE-2016-5253
OPENSUSE-SU-2024:10071-1
OPENSUSE-SU-2024:14572-1

Produtos afetados

Alt Linux
Firefox