Vulnerability Description
The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 45.5.0 |
| Mozilla | Thunderbird | < 45.5.0 |
| Microsoft | Windows | - |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/94336Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1037298Third Party AdvisoryVDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1246972ExploitIssue TrackingVendor Advisory
- https://security.gentoo.org/glsa/201701-15Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2016-89/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2016-90/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2016-93/Vendor Advisory
- http://www.securityfocus.com/bid/94336Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1037298Third Party AdvisoryVDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1246972ExploitIssue TrackingVendor Advisory
- https://security.gentoo.org/glsa/201701-15Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2016-89/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2016-90/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2016-93/Vendor Advisory
FAQ
What is CVE-2016-5294?
CVE-2016-5294 is a vulnerability with a CVSS score of 5.5 (MEDIUM). The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vulnerability requires local system access. Note: this issue on...
How severe is CVE-2016-5294?
CVE-2016-5294 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-5294?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Thunderbird, Microsoft Windows.