CVE-2015-2720 — Mozilla Firefox vulnerability
Severity
4.4MEDIUMNVD
EPSS
0.1%
top 77.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 14
Latest updateMay 17
Description
The update implementation in Mozilla Firefox before 38.0 on Windows does not ensure that the pathname for updater.exe corresponds to the application directory, which might allow local users to gain privileges via a Trojan horse file.
CVSS vector
AV:L/AC:M/C:P/I:P/A:PExploitability: 3.4 | Impact: 6.4