Description
Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Updater in Mozilla Firefox before 23.0, Firefox ESR 17.x before 17.0.8, Thunderbird before 17.0.8, and Thunderbird ESR 17.x before 17.0.8 on Windows 7, Windows Server 2008 R2, Windows 8, and Windows Server 2012 allow local users to gain privileges via a Trojan horse DLL in (1) the update directory or (2) the current working directory.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18014
Vendor Advisory x_refsource_confirm
http://www.mozilla.org/security/announce/2013/mfsa2013-71.html
Issue Tracking x_refsource_confirm
https://bugzilla.mozilla.org/show_bug.cgi?id=859072
Scores
EPSS
0.0039
EPSS Percentile
30.9%
Details
Status
published
Products (31)
mozilla/firefox
17.0
mozilla/firefox
17.0.1
mozilla/firefox
17.0.2
mozilla/firefox
17.0.3
mozilla/firefox
17.0.4
mozilla/firefox
17.0.5
mozilla/firefox
17.0.6
mozilla/firefox
17.0.7
mozilla/firefox
19.0
mozilla/firefox
19.0.1
... and 21 more
Published
Aug 07, 2013
Tracked Since
Feb 18, 2026