VulnerabilityModified
CVE-2012-4206
Untrusted search path vulnerability in the installer in Mozilla Firefox before 17.0 and Firefox ESR 10.x before 10.0.11 on Windows allows local users to gain privileges via a Trojan horse DLL in the default downloads directory.
MEDIUM 6.9EPSS 0.33%
Does this matter?
Lower severity and a low EPSS score (0.33%). Track it; it rarely justifies an emergency change on its own.
Description
Untrusted search path vulnerability in the installer in Mozilla Firefox before 17.0 and Firefox ESR 10.x before 10.0.11 on Windows allows local users to gain privileges via a Trojan horse DLL in the default downloads directory.
- CVSS 2.0
- 6.9 MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 0.33% probability · 26th percentile
- CISA KEV
- Not listed
- Affected
- mozilla/firefox
- Source
- cve@mitre.org
References
- http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html
- http://www.mozilla.org/security/announce/2012/mfsa2012-98.htmlVendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=792106
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80176
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16991
- http://lists.opensuse.org/opensuse-security-announce/2012-11/msg00021.html
- http://www.mozilla.org/security/announce/2012/mfsa2012-98.htmlVendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=792106
- https://exchange.xforce.ibmcloud.com/vulnerabilities/80176
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16991
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.