PT-2016-6351 · Mozilla+2 · Firefox+2

Holger Fuhrmannek · Publicado 2016-11-15 · Atualizado 2024-12-12 · CVE-2016-5295

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 50

Description This issue allows an attacker to escalate privilege by using the Mozilla Maintenance Service to invoke the Mozilla Updater, which can run malicious local files. It requires local system access and only affects Windows operating systems.

Recommendations For versions prior to 50, update to version 50 or later to resolve the issue. As a temporary workaround, consider restricting access to the Mozilla Maintenance Service and Mozilla Updater until a patch is applied. Avoid using the Maintenance Service to invoke the Mozilla Updater for untrusted or unknown local files.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2016-2307

CVE-2016-5295

OPENSUSE-SU-2016_3011-1

OPENSUSE-SU-2024:10071-1

OPENSUSE-SU-2024:14572-1

Produtos afetados

Alt Linux

Firefox

Suse

Referências · 2064

• https://suse.com/security/cve/CVE-2023-25728 · Nota
• https://suse.com/security/cve/CVE-2022-31743 · Nota
• https://suse.com/security/cve/CVE-2018-12392 · Nota
• https://suse.com/security/cve/CVE-2024-5698 · Nota
• https://suse.com/security/cve/CVE-2013-1701 · Nota
• https://suse.com/security/cve/CVE-2024-5687 · Nota
• https://suse.com/security/cve/CVE-2022-24713 · Nota
• https://suse.com/security/cve/CVE-2014-8642 · Nota
• https://suse.com/security/cve/CVE-2012-4196 · Nota
• https://suse.com/security/cve/CVE-2015-4516 · Nota
• https://suse.com/security/cve/CVE-2019-11716 · Nota
• https://suse.com/security/cve/CVE-2023-28176 · Nota
• https://suse.com/security/cve/CVE-2021-38494 · Nota
• https://suse.com/security/cve/CVE-2012-1965 · Nota
• https://suse.com/security/cve/CVE-2009-3071 · Nota