PT-2016-2530 · Mozilla+1 · Firefox+1
Holger Fuhrmannek
·
Published
2016-08-02
·
Updated
2024-12-12
·
CVE-2016-5253
CVSS v3.1
4.7
Medium
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
Mozilla Firefox versions prior to 48.0
Description
The issue is related to the Updater component in Mozilla Firefox, which allows local users to write to arbitrary files. This is achieved through vectors involving the
application-path parameter and a hard link. The vulnerability is associated with insufficient access control, enabling a local attacker to modify arbitrary files by exploiting the parameter and hard link.Recommendations
For versions prior to 48.0, update to version 48.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the Updater component until a patch is available. Avoid using the
application-path parameter in sensitive operations until the issue is resolved.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Firefox