PT-2016-6351 · Mozilla+2 · Firefox+2
Holger Fuhrmannek
·
Published
2016-11-15
·
Updated
2024-12-12
·
CVE-2016-5295
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 50
Description
This issue allows an attacker to escalate privilege by using the Mozilla Maintenance Service to invoke the Mozilla Updater, which can run malicious local files. It requires local system access and only affects Windows operating systems.
Recommendations
For versions prior to 50, update to version 50 or later to resolve the issue. As a temporary workaround, consider restricting access to the Mozilla Maintenance Service and Mozilla Updater until a patch is applied. Avoid using the Maintenance Service to invoke the Mozilla Updater for untrusted or unknown local files.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Firefox
Suse