PT-2016-2199 · Mozilla · Firefox Esr+1

Frédéric Hoguin · Published 2016-06-07 · Updated 2024-10-22 · CVE-2016-2826

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 47.0 Mozilla Firefox ESR versions prior to 45.2

Description The issue is related to the maintenance service in Mozilla Firefox, which does not properly prevent modification of extracted files during the execution of the updater. This might allow local users to gain privileges via a Trojan horse file. The vulnerability is associated with insufficient access control, which can be exploited by a local attacker to elevate their privileges using a malicious file.

Recommendations For Mozilla Firefox versions prior to 47.0, update to version 47.0 or later. For Mozilla Firefox ESR versions prior to 45.2, update to version 45.2 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2016-01552

CVE-2016-2826

Affected Products

Firefox

Firefox Esr

References · 7

• http://mozilla.org/security/announce/2016/mfsa2016-55.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2826 · Security Note
• https://bdu.fstec.ru/vul/2016-01552 · Security Note
• https://osv.dev/vulnerability/CVE-2016-2826 · Vendor Advisory
• http://securityfocus.com/bid/91075 · Note
• http://securitytracker.com/id/1036057 · Note
• https://bugzilla.mozilla.org/show_bug.cgi?id=1237219 · Note