PT-2012-5249 · Mozilla+1 · Firefox+2

Robert Kugler · Published 2012-11-20 · Updated 2024-10-21 · CVE-2012-4206

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 17.0 Mozilla Firefox ESR 10.x versions prior to 10.0.11

Description The issue is related to an untrusted search path vulnerability in the installer. This vulnerability allows local users to gain privileges via a Trojan horse DLL in the default downloads directory.

Recommendations For Mozilla Firefox versions prior to 17.0, update to version 17.0 or later. For Mozilla Firefox ESR 10.x versions prior to 10.0.11, update to version 10.0.11 or later.

Fix

Related Identifiers

CVE-2012-4206

Affected Products

Firefox

Firefox Esr

Suse

References · 8

• http://mozilla.org/security/announce/2012/mfsa2012-98.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2012-98 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4206 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-4206 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/80176 · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=792106 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16991 · Note