CVE-2016-5294

LOW

Description

The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.

References

http://www.securityfocus.com/bid/94336

http://www.securitytracker.com/id/1037298

https://bugzilla.mozilla.org/show_bug.cgi?id=1246972

https://security.gentoo.org/glsa/201701-15

https://www.mozilla.org/security/advisories/mfsa2016-89/

https://www.mozilla.org/security/advisories/mfsa2016-90/

https://www.mozilla.org/security/advisories/mfsa2016-93/

Details

Source: MITRE

Published: 2018-06-11

Updated: 2018-07-30

Type: CWE-20

Risk Information

CVSS v2.0

Base Score: 2.1

Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N

Impact Score: 2.9

Exploitability Score: 3.9

Severity: LOW

CVSS v3.0

Base Score: 5.5

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Impact Score: 3.6

Exploitability Score: 1.8

Severity: MEDIUM