CVE-2010-3131

high

Description

Untrusted search path vulnerability in Mozilla Firefox before 3.5.12 and 3.6.x before 3.6.9, Thunderbird before 3.0.7 and 3.1.x before 3.1.3, and SeaMonkey before 2.0.7 on Windows XP allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .htm, .html, .jtx, .mfp, or .eml file.

References

http://lists.opensuse.org/opensuse-security-announce/2010-10/msg00002.html

https://bugzilla.mozilla.org/show_bug.cgi?id=579593

http://secunia.com/advisories/41095

http://secunia.com/advisories/41168

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12143

http://www.exploit-db.com/exploits/14730

http://www.exploit-db.com/exploits/14783

http://www.mozilla.org/security/announce/2010/mfsa2010-52.html

http://www.vupen.com/english/advisories/2010/2169

http://www.vupen.com/english/advisories/2010/2201

http://www.vupen.com/english/advisories/2010/2323

Details

Source: Mitre, NVD

Published: 2010-08-26

Risk Information

CVSS v2

Base Score: 9.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

Severity: High