CVEvulnerability
CVE-2015-2720
4.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2015-05-14
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.4 MEDIUM — AV:L/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-17
Description
The update implementation in Mozilla Firefox before 38.0 on Windows does not ensure that the pathname for updater.exe corresponds to the application directory, which might allow local users to gain privileges via a Trojan horse file.
Affected configurations
• mozilla firefox (<= 37.0.2)
Related
Weakness · not in database (1)
References
- http://www.mozilla.org/security/announce/2015/mfsa2015-58.html www.mozilla.org
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html www.oracle.com
- http://www.securityfocus.com/bid/74611 www.securityfocus.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=1127481 bugzilla.mozilla.org
- http://www.mozilla.org/security/announce/2015/mfsa2015-58.html www.mozilla.org
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html www.oracle.com
- http://www.securityfocus.com/bid/74611 www.securityfocus.com
- https://bugzilla.mozilla.org/show_bug.cgi?id=1127481 bugzilla.mozilla.org