CVE-2023-29542

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-29542
A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code. *This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1810793 Permissions Required
https://bugzilla.mozilla.org/show_bug.cgi?id=1815062 Permissions Required
https://www.mozilla.org/security/advisories/mfsa2023-13/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-14/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2023-15/ Vendor Advisory
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
History

27 Jun 2023, 08:51

Type Values Removed Values Added
CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
First Time Mozilla thunderbird
Mozilla
Mozilla firefox
Mozilla firefox Esr
Microsoft windows
Microsoft
CWE NVD-CWE-noinfo
References (MISC) https://bugzilla.mozilla.org/show_bug.cgi?id=1810793 - (MISC) https://bugzilla.mozilla.org/show_bug.cgi?id=1810793 - Permissions Required
References (MISC) https://bugzilla.mozilla.org/show_bug.cgi?id=1815062 - (MISC) https://bugzilla.mozilla.org/show_bug.cgi?id=1815062 - Permissions Required
References (MISC) https://www.mozilla.org/security/advisories/mfsa2023-14/ - (MISC) https://www.mozilla.org/security/advisories/mfsa2023-14/ - Vendor Advisory
References (MISC) https://www.mozilla.org/security/advisories/mfsa2023-13/ - (MISC) https://www.mozilla.org/security/advisories/mfsa2023-13/ - Vendor Advisory
References (MISC) https://www.mozilla.org/security/advisories/mfsa2023-15/ - (MISC) https://www.mozilla.org/security/advisories/mfsa2023-15/ - Vendor Advisory

19 Jun 2023, 11:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-06-19 11:15

Updated : 2023-12-10 15:01

NVD link : CVE-2023-29542

Mitre link : CVE-2023-29542

CVE.ORG link : CVE-2023-29542

JSON object : View

Products Affected

microsoft

  • windows

mozilla

  • firefox_esr
  • thunderbird
  • firefox
CWE
NVD-CWE-noinfo