← back
CVE-2016-5294

CVE-2016-5294

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 0.4%
exploitation probability
0.4%top 66% of all CVEs
observed exploitation
nono source reports it
The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
Affected products
Mozilla · FirefoxMozilla · Firefox ESRMozilla · Thunderbird
References
https://bugzilla.mozilla.org/show_bug.cgi?id=1246972https://security.gentoo.org/glsa/201701-15https://www.mozilla.org/security/advisories/mfsa2016-89/https://www.mozilla.org/security/advisories/mfsa2016-90/https://www.mozilla.org/security/advisories/mfsa2016-93/http://www.securityfocus.com/bid/94336http://www.securitytracker.com/id/1037298