Vulnerability Description
maintenservice_installer.exe in the Maintenance Service Installer in Mozilla Firefox before 29.0 and Firefox ESR 24.x before 24.5 on Windows allows local users to gain privileges by placing a Trojan horse DLL file into a temporary directory at an unspecified point in the update process.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 29.0 |
| Microsoft | Windows | All versions |
| Fedoraproject | Fedora | 19 |
Related Weaknesses (CWE)
References
- http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132332.htmlThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132437.htmlThird Party Advisory
- http://packetstormsecurity.com/files/161696/Mozilla-Arbitrary-Code-Execution-PriThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2021/Mar/14Mailing ListThird Party Advisory
- http://secunia.com/advisories/59866Third Party Advisory
- http://www.mozilla.org/security/announce/2014/mfsa2014-35.htmlVendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
- http://www.securitytracker.com/id/1030163Third Party AdvisoryVDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=961676ExploitIssue TrackingPatch
- https://security.gentoo.org/glsa/201504-01Third Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132332.htmlThird Party Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2014-May/132437.htmlThird Party Advisory
- http://packetstormsecurity.com/files/161696/Mozilla-Arbitrary-Code-Execution-PriThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2021/Mar/14Mailing ListThird Party Advisory
- http://secunia.com/advisories/59866Third Party Advisory
FAQ
What is CVE-2014-1520?
CVE-2014-1520 is a vulnerability with a CVSS score of 6.9 (MEDIUM). maintenservice_installer.exe in the Maintenance Service Installer in Mozilla Firefox before 29.0 and Firefox ESR 24.x before 24.5 on Windows allows local users to gain privileges by placing a Trojan h...
How severe is CVE-2014-1520?
CVE-2014-1520 has been rated MEDIUM with a CVSS base score of 6.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-1520?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Microsoft Windows, Fedoraproject Fedora.