CVE-2012-3974 — Mozilla Firefox vulnerability

CWE-3996 documents6 sources
Severity
6.9MEDIUMNVD
EPSS
0.1%
top 69.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mozilla FirefoxMozilla ThunderbirdMozilla Thunderbird ESR
Timeline
PublishedAug 29
Latest updateMay 17

Description

Untrusted search path vulnerability in the installer in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, and Thunderbird ESR 10.x before 10.0.7 on Windows allows local users to gain privileges via a Trojan horse executable file in a root directory.

CVSS vector

AV:L/AC:M/C:C/I:C/A:CExploitability: 3.4 | Impact: 10.0

Affected Packages3 packages

▶NVDmozilla/firefox14.0+134
▶NVDmozilla/thunderbird14.0+101
▶NVDmozilla/thunderbird_esr7 versions+6

🔴Vulnerability Details

2
GHSA
GHSA-2pj2-w39h-8vvq: Untrusted search path vulnerability in the installer in Mozilla Firefox before 15↗2022-05-17
▶
CVEList
CVE-2012-3974: Untrusted search path vulnerability in the installer in Mozilla Firefox before 15↗2012-08-29
▶

📋Vendor Advisories

1
Red Hat
Mozilla: Installer will launch incorrect executable following new installation (MFSA 2012-67)↗2012-08-28
▶

💬Community

1
Bugzilla
CVE-2012-3974 Mozilla: Installer will launch incorrect executable following new installation (MFSA 2012-67)↗2012-08-27
▶
CVE-2012-3974 — Mozilla Firefox vulnerability | cvebase