PT-2013-3344 · Mozilla+1 · Firefox+5

Holger Fuhrmannek · Published 2013-08-07 · Updated 2024-10-21 · CVE-2013-1712

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 23.0 Firefox ESR 17.x versions prior to 17.0.8 Thunderbird versions prior to 17.0.8 Thunderbird ESR 17.x versions prior to 17.0.8

Description The issue allows local users to gain privileges via a Trojan horse DLL in the update directory or the current working directory. This is due to multiple untrusted search path vulnerabilities in updater.exe in Mozilla Updater.

Recommendations For Mozilla Firefox versions prior to 23.0, update to version 23.0 or later. For Firefox ESR 17.x versions prior to 17.0.8, update to version 17.0.8 or later. For Thunderbird versions prior to 17.0.8, update to version 17.0.8 or later. For Thunderbird ESR 17.x versions prior to 17.0.8, update to version 17.0.8 or later.

Fix

Related Identifiers

CVE-2013-1712

Affected Products

Firefox Esr

Firefox

Updater

Suse

Thunderbird

Thunderbird Esr

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-1712 · Security Note
• http://mozilla.org/security/announce/2013/mfsa2013-71.html · Vendor Advisory
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18014 · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=859072 · Note