Vulnerability in Microsoft Windows
CVE-2023-29542
A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code. *This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.009 (60.3th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 60th percentile — 60.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.009 · newest: 0.009 · change: 0.000
Affected products
- Microsoft Windows
- Mozilla Firefox — versions unspecified
- Mozilla Firefox Esr — versions unspecified
- Mozilla Firefox Esr
- Mozilla Thunderbird — versions unspecified
References
- bugzilla.mozilla.org/show_bug.cgi (Permissions Required)
- bugzilla.mozilla.org/show_bug.cgi (Permissions Required)
- www.mozilla.org/security/advisories/mfsa2023-13/ (Vendor Advisory)
- www.mozilla.org/security/advisories/mfsa2023-14/ (Vendor Advisory)
- www.mozilla.org/security/advisories/mfsa2023-15/ (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-29542?
- CVE-2023-29542 is a critical-severity vulnerability in Microsoft Windows. CVSS score: 9.8/10. Published 2023-06-19.
- How severe is CVE-2023-29542?
- Critical severity. CVSS v3 base score is 9.8 out of 10.