PT-2023-2792 · Mozilla+3 · Firefox Esr+5
Ameen Basha M K
+1
·
Published
2023-04-11
·
Updated
2024-12-12
·
CVE-2023-29542
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Mozilla Firefox versions prior to 112
Mozilla Firefox ESR versions prior to 102.10
Mozilla Thunderbird versions prior to 102.10
Description
The issue is related to the incorrect handling of a newline in a filename, which could allow a remote attacker to bypass file extension security mechanisms. This mechanism replaces malicious file extensions, such as .lnk, with .download. The bypass could lead to the accidental execution of malicious code. This bug only affects Firefox and Thunderbird on Windows, with other versions of these applications being unaffected.
Recommendations
For Mozilla Firefox versions prior to 112, update to version 112 or later.
For Mozilla Firefox ESR versions prior to 102.10, update to version 102.10 or later.
For Mozilla Thunderbird versions prior to 102.10, update to version 102.10 or later.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Firefox
Firefox Esr
Thunderbird
Red Os
Suse