CVE-2016-5293 — Improper Input Validation in Mozilla Firefox

CWE-20 — Improper Input Validation3 documents3 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 78.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Mozilla FirefoxMozilla Firefox ESRDebian Linux+2 more
Timeline
PublishedJun 11
Latest updateMay 14

Description

When the Mozilla Updater is run, if the Updater's log file in the working directory points to a hardlink, data can be appended to an arbitrary local file. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Firefox ESR < 45.5 and Firefox < 50.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5mozilla/firefoxunspecified — 50
▶NVDmozilla/firefox< 45.5.0+1
▶CVEListV5mozilla/firefox_esrunspecified — 45.5

Also affects: Debian Linux 8.0

🔴Vulnerability Details

1
GHSA
GHSA-4m4x-qm8m-cxqj: When the Mozilla Updater is run, if the Updater's log file in the working directory points to a hardlink, data can be appended to an arbitrary local f↗2022-05-14
▶

📋Vendor Advisories

1
Debian
CVE-2016-5293: firefox - When the Mozilla Updater is run, if the Updater's log file in the working direct...↗2016
▶