Vulnerability Description
A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code. *This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 112.0 |
| Mozilla | Firefox Esr | < 102.10 |
| Mozilla | Thunderbird | < 102.10 |
| Microsoft | Windows | - |
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=1810793Permissions Required
- https://bugzilla.mozilla.org/show_bug.cgi?id=1815062Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2023-13/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-14/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-15/Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1810793Permissions Required
- https://bugzilla.mozilla.org/show_bug.cgi?id=1815062Permissions Required
- https://www.mozilla.org/security/advisories/mfsa2023-13/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-14/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2023-15/Vendor Advisory
FAQ
What is CVE-2023-29542?
CVE-2023-29542 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental exe...
How severe is CVE-2023-29542?
CVE-2023-29542 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-29542?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Mozilla Firefox Esr, Mozilla Thunderbird, Microsoft Windows.