Vulnerability in Microsoft Windows
CVE-2015-4481
Race condition in the Mozilla Maintenance Service in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Windows allows local users to write to arbitrary files and consequently gain privileges via vectors involving a hard link to a log file during an update.
Vulnerability class: Race Condition
EPSS: 0.008 (52.8th percentile) — read the EPSS interpretation.
Affected products
- Microsoft Windows
- Mozilla Firefox — versions 38.0, 38.0.1, 38.0.5
- Oracle Solaris — versions 11.3
- Opensuse — versions 13.1, 13.2
- N/a — versions n/a
Weakness classification (CWE)
References
- security@mozilla.org (x_refsource_CONFIRM, Issue Tracking)
- security@mozilla.org (vendor-advisory, x_refsource_SUSE)
- security@mozilla.org (vendor-advisory, Third Party Advisory, x_refsource_SUSE)
- security@mozilla.org (vendor-advisory, x_refsource_SUSE)
- security@mozilla.org (x_refsource_CONFIRM, Vendor Advisory)
- security@mozilla.org (exploit, x_refsource_EXPLOIT-DB)
- security@mozilla.org (x_refsource_CONFIRM, Third Party Advisory)
- security@mozilla.org (vdb-entry, x_refsource_SECTRACK)
- security@mozilla.org (vendor-advisory, x_refsource_GENTOO)
- security@mozilla.org (vdb-entry, x_refsource_SECTRACK)