First published: Wed Feb 25 2015(Updated: )
Multiple untrusted search path vulnerabilities in updater.exe in Mozilla Firefox before 36.0, Firefox ESR 31.x before 31.5, and Thunderbird before 31.5 on Windows, when the Maintenance Service is not used, allow local users to gain privileges via a Trojan horse DLL in (1) the current working directory or (2) a temporary directory, as demonstrated by bcrypt.dll.
Credit: security@mozilla.org security@mozilla.org
Affected Software | Affected Version | How to fix |
---|---|---|
Evergreen ILS | =11.4 | |
openSUSE | =13.1 | |
openSUSE | =13.2 | |
All of | ||
Any of | ||
Firefox | <=35.0.1 | |
Firefox | =0.1 | |
Firefox | =0.2 | |
Firefox | =0.3 | |
Firefox | =0.4 | |
Firefox | =0.5 | |
Firefox | =0.6 | |
Firefox | =0.6.1 | |
Firefox | =0.7 | |
Firefox | =0.7.1 | |
Firefox | =0.8 | |
Firefox | =0.9 | |
Firefox | =0.9-rc | |
Firefox | =0.9.1 | |
Firefox | =0.9.2 | |
Firefox | =0.9.3 | |
Firefox | =0.10 | |
Firefox | =0.10.1 | |
Firefox | =1.0 | |
Firefox | =1.0-preview_release | |
Firefox | =1.0.1 | |
Firefox | =1.0.2 | |
Firefox | =1.0.3 | |
Firefox | =1.0.4 | |
Firefox | =1.0.5 | |
Firefox | =1.0.6 | |
Firefox | =1.0.7 | |
Firefox | =1.0.8 | |
Firefox | =1.4.1 | |
Firefox | =1.5 | |
Firefox | =1.5-beta1 | |
Firefox | =1.5-beta2 | |
Firefox | =1.5.0.1 | |
Firefox | =1.5.0.2 | |
Firefox | =1.5.0.3 | |
Firefox | =1.5.0.4 | |
Firefox | =1.5.0.5 | |
Firefox | =1.5.0.6 | |
Firefox | =1.5.0.7 | |
Firefox | =1.5.0.8 | |
Firefox | =1.5.0.9 | |
Firefox | =1.5.0.10 | |
Firefox | =1.5.0.11 | |
Firefox | =1.5.0.12 | |
Firefox | =1.5.1 | |
Firefox | =1.5.2 | |
Firefox | =1.5.3 | |
Firefox | =1.5.4 | |
Firefox | =1.5.5 | |
Firefox | =1.5.6 | |
Firefox | =1.5.7 | |
Firefox | =1.5.8 | |
Firefox | =1.8 | |
Firefox | =2.0 | |
Firefox | =2.0.0.1 | |
Firefox | =2.0.0.2 | |
Firefox | =2.0.0.3 | |
Firefox | =2.0.0.4 | |
Firefox | =2.0.0.5 | |
Firefox | =2.0.0.6 | |
Firefox | =2.0.0.7 | |
Firefox | =2.0.0.8 | |
Firefox | =2.0.0.9 | |
Firefox | =2.0.0.10 | |
Firefox | =2.0.0.11 | |
Firefox | =2.0.0.12 | |
Firefox | =2.0.0.13 | |
Firefox | =2.0.0.14 | |
Firefox | =2.0.0.15 | |
Firefox | =2.0.0.16 | |
Firefox | =2.0.0.17 | |
Firefox | =2.0.0.18 | |
Firefox | =2.0.0.19 | |
Firefox | =2.0.0.20 | |
Firefox | =3.0 | |
Firefox | =3.0.1 | |
Firefox | =3.0.2 | |
Firefox | =3.0.3 | |
Firefox | =3.0.4 | |
Firefox | =3.0.5 | |
Firefox | =3.0.6 | |
Firefox | =3.0.7 | |
Firefox | =3.0.8 | |
Firefox | =3.0.9 | |
Firefox | =3.0.10 | |
Firefox | =3.0.11 | |
Firefox | =3.0.12 | |
Firefox | =3.0.13 | |
Firefox | =3.0.14 | |
Firefox | =3.0.15 | |
Firefox | =3.0.16 | |
Firefox | =3.0.17 | |
Firefox | =3.0.18 | |
Firefox | =3.0.19 | |
Firefox | =3.5 | |
Firefox | =3.5.1 | |
Firefox | =3.5.2 | |
Firefox | =3.5.3 | |
Firefox | =3.5.4 | |
Firefox | =3.5.5 | |
Firefox | =3.5.6 | |
Firefox | =3.5.7 | |
Firefox | =3.5.8 | |
Firefox | =3.5.9 | |
Firefox | =3.5.10 | |
Firefox | =3.5.11 | |
Firefox | =3.5.12 | |
Firefox | =3.5.13 | |
Firefox | =3.5.14 | |
Firefox | =3.5.15 | |
Firefox | =3.5.16 | |
Firefox | =3.5.17 | |
Firefox | =3.5.18 | |
Firefox | =3.5.19 | |
Firefox | =3.6 | |
Firefox | =3.6.2 | |
Firefox | =3.6.3 | |
Firefox | =3.6.4 | |
Firefox | =3.6.6 | |
Firefox | =3.6.7 | |
Firefox | =3.6.8 | |
Firefox | =3.6.9 | |
Firefox | =3.6.10 | |
Firefox | =3.6.11 | |
Firefox | =3.6.12 | |
Firefox | =3.6.13 | |
Firefox | =3.6.14 | |
Firefox | =3.6.15 | |
Firefox | =3.6.16 | |
Firefox | =3.6.17 | |
Firefox | =3.6.18 | |
Firefox | =3.6.19 | |
Firefox | =3.6.20 | |
Firefox | =3.6.21 | |
Firefox | =3.6.22 | |
Firefox | =3.6.23 | |
Firefox | =3.6.24 | |
Firefox | =3.6.25 | |
Firefox | =3.6.26 | |
Firefox | =3.6.27 | |
Firefox | =3.6.28 | |
Firefox | =4.0 | |
Firefox | =4.0-beta1 | |
Firefox | =4.0-beta10 | |
Firefox | =4.0-beta11 | |
Firefox | =4.0-beta12 | |
Firefox | =4.0-beta2 | |
Firefox | =4.0-beta3 | |
Firefox | =4.0-beta4 | |
Firefox | =4.0-beta5 | |
Firefox | =4.0-beta6 | |
Firefox | =4.0-beta7 | |
Firefox | =4.0-beta8 | |
Firefox | =4.0-beta9 | |
Firefox | =4.0.1 | |
Firefox | =5.0 | |
Firefox | =5.0.1 | |
Firefox | =6.0 | |
Firefox | =6.0.1 | |
Firefox | =6.0.2 | |
Firefox | =7.0 | |
Firefox | =7.0.1 | |
Firefox | =8.0 | |
Firefox | =8.0.1 | |
Firefox | =9.0 | |
Firefox | =9.0.1 | |
Firefox | =10.0 | |
Firefox | =10.0.1 | |
Firefox | =10.0.2 | |
Firefox | =10.0.3 | |
Firefox | =10.0.4 | |
Firefox | =10.0.5 | |
Firefox | =10.0.6 | |
Firefox | =10.0.7 | |
Firefox | =10.0.8 | |
Firefox | =10.0.9 | |
Firefox | =10.0.10 | |
Firefox | =10.0.11 | |
Firefox | =10.0.12 | |
Firefox | =11.0 | |
Firefox | =12.0 | |
Firefox | =12.0-beta6 | |
Firefox | =13.0 | |
Firefox | =13.0.1 | |
Firefox | =14.0 | |
Firefox | =14.0.1 | |
Firefox | =15.0 | |
Firefox | =15.0.1 | |
Firefox | =16.0 | |
Firefox | =16.0.1 | |
Firefox | =16.0.2 | |
Firefox | =17.0 | |
Firefox | =17.0.1 | |
Firefox | =17.0.2 | |
Firefox | =17.0.3 | |
Firefox | =17.0.4 | |
Firefox | =17.0.5 | |
Firefox | =17.0.6 | |
Firefox | =17.0.7 | |
Firefox | =17.0.8 | |
Firefox | =17.0.9 | |
Firefox | =17.0.10 | |
Firefox | =17.0.11 | |
Firefox | =18.0 | |
Firefox | =18.0.1 | |
Firefox | =18.0.2 | |
Firefox | =19.0 | |
Firefox | =19.0.1 | |
Firefox | =19.0.2 | |
Firefox | =20.0 | |
Firefox | =20.0.1 | |
Firefox | =21.0 | |
Firefox | =22.0 | |
Firefox | =23.0 | |
Firefox | =23.0.1 | |
Firefox | =24.0 | |
Firefox | =24.1 | |
Firefox | =24.1.1 | |
Firefox | =25.0 | |
Firefox | =25.0.1 | |
Firefox | =26.0 | |
Firefox | =27.0 | |
Firefox | =27.0.1 | |
Firefox | =28.0 | |
Firefox | =29.0 | |
Firefox | =29.0.1 | |
Firefox | =30.0 | |
Firefox | =31.0 | |
Firefox | =31.1.0 | |
Firefox | =32.0 | |
Firefox | =33.0 | |
Firefox | =34.0.5 | |
Microsoft Windows Operating System | ||
All of | ||
Any of | ||
Thunderbird | <=31.4 | |
Thunderbird | =31.0 | |
Thunderbird | =31.1.2 | |
Thunderbird | =31.2 | |
Thunderbird | =31.3 | |
Microsoft Windows Operating System | ||
All of | ||
Any of | ||
Firefox | =31.0 | |
Firefox | =31.1.1 | |
Firefox ESR | =31.1 | |
Firefox ESR | =31.2 | |
Firefox ESR | =31.3 | |
Firefox ESR | =31.4 | |
Firefox ESR | =31.5 | |
Microsoft Windows Operating System | ||
Firefox | <=35.0.1 | |
Firefox | =0.1 | |
Firefox | =0.2 | |
Firefox | =0.3 | |
Firefox | =0.4 | |
Firefox | =0.5 | |
Firefox | =0.6 | |
Firefox | =0.6.1 | |
Firefox | =0.7 | |
Firefox | =0.7.1 | |
Firefox | =0.8 | |
Firefox | =0.9 | |
Firefox | =0.9-rc | |
Firefox | =0.9.1 | |
Firefox | =0.9.2 | |
Firefox | =0.9.3 | |
Firefox | =0.10 | |
Firefox | =0.10.1 | |
Firefox | =1.0 | |
Firefox | =1.0-preview_release | |
Firefox | =1.0.1 | |
Firefox | =1.0.2 | |
Firefox | =1.0.3 | |
Firefox | =1.0.4 | |
Firefox | =1.0.5 | |
Firefox | =1.0.6 | |
Firefox | =1.0.7 | |
Firefox | =1.0.8 | |
Firefox | =1.4.1 | |
Firefox | =1.5 | |
Firefox | =1.5-beta1 | |
Firefox | =1.5-beta2 | |
Firefox | =1.5.0.1 | |
Firefox | =1.5.0.2 | |
Firefox | =1.5.0.3 | |
Firefox | =1.5.0.4 | |
Firefox | =1.5.0.5 | |
Firefox | =1.5.0.6 | |
Firefox | =1.5.0.7 | |
Firefox | =1.5.0.8 | |
Firefox | =1.5.0.9 | |
Firefox | =1.5.0.10 | |
Firefox | =1.5.0.11 | |
Firefox | =1.5.0.12 | |
Firefox | =1.5.1 | |
Firefox | =1.5.2 | |
Firefox | =1.5.3 | |
Firefox | =1.5.4 | |
Firefox | =1.5.5 | |
Firefox | =1.5.6 | |
Firefox | =1.5.7 | |
Firefox | =1.5.8 | |
Firefox | =1.8 | |
Firefox | =2.0 | |
Firefox | =2.0.0.1 | |
Firefox | =2.0.0.2 | |
Firefox | =2.0.0.3 | |
Firefox | =2.0.0.4 | |
Firefox | =2.0.0.5 | |
Firefox | =2.0.0.6 | |
Firefox | =2.0.0.7 | |
Firefox | =2.0.0.8 | |
Firefox | =2.0.0.9 | |
Firefox | =2.0.0.10 | |
Firefox | =2.0.0.11 | |
Firefox | =2.0.0.12 | |
Firefox | =2.0.0.13 | |
Firefox | =2.0.0.14 | |
Firefox | =2.0.0.15 | |
Firefox | =2.0.0.16 | |
Firefox | =2.0.0.17 | |
Firefox | =2.0.0.18 | |
Firefox | =2.0.0.19 | |
Firefox | =2.0.0.20 | |
Firefox | =3.0 | |
Firefox | =3.0.1 | |
Firefox | =3.0.2 | |
Firefox | =3.0.3 | |
Firefox | =3.0.4 | |
Firefox | =3.0.5 | |
Firefox | =3.0.6 | |
Firefox | =3.0.7 | |
Firefox | =3.0.8 | |
Firefox | =3.0.9 | |
Firefox | =3.0.10 | |
Firefox | =3.0.11 | |
Firefox | =3.0.12 | |
Firefox | =3.0.13 | |
Firefox | =3.0.14 | |
Firefox | =3.0.15 | |
Firefox | =3.0.16 | |
Firefox | =3.0.17 | |
Firefox | =3.0.18 | |
Firefox | =3.0.19 | |
Firefox | =3.5 | |
Firefox | =3.5.1 | |
Firefox | =3.5.2 | |
Firefox | =3.5.3 | |
Firefox | =3.5.4 | |
Firefox | =3.5.5 | |
Firefox | =3.5.6 | |
Firefox | =3.5.7 | |
Firefox | =3.5.8 | |
Firefox | =3.5.9 | |
Firefox | =3.5.10 | |
Firefox | =3.5.11 | |
Firefox | =3.5.12 | |
Firefox | =3.5.13 | |
Firefox | =3.5.14 | |
Firefox | =3.5.15 | |
Firefox | =3.5.16 | |
Firefox | =3.5.17 | |
Firefox | =3.5.18 | |
Firefox | =3.5.19 | |
Firefox | =3.6 | |
Firefox | =3.6.2 | |
Firefox | =3.6.3 | |
Firefox | =3.6.4 | |
Firefox | =3.6.6 | |
Firefox | =3.6.7 | |
Firefox | =3.6.8 | |
Firefox | =3.6.9 | |
Firefox | =3.6.10 | |
Firefox | =3.6.11 | |
Firefox | =3.6.12 | |
Firefox | =3.6.13 | |
Firefox | =3.6.14 | |
Firefox | =3.6.15 | |
Firefox | =3.6.16 | |
Firefox | =3.6.17 | |
Firefox | =3.6.18 | |
Firefox | =3.6.19 | |
Firefox | =3.6.20 | |
Firefox | =3.6.21 | |
Firefox | =3.6.22 | |
Firefox | =3.6.23 | |
Firefox | =3.6.24 | |
Firefox | =3.6.25 | |
Firefox | =3.6.26 | |
Firefox | =3.6.27 | |
Firefox | =3.6.28 | |
Firefox | =4.0 | |
Firefox | =4.0-beta1 | |
Firefox | =4.0-beta10 | |
Firefox | =4.0-beta11 | |
Firefox | =4.0-beta12 | |
Firefox | =4.0-beta2 | |
Firefox | =4.0-beta3 | |
Firefox | =4.0-beta4 | |
Firefox | =4.0-beta5 | |
Firefox | =4.0-beta6 | |
Firefox | =4.0-beta7 | |
Firefox | =4.0-beta8 | |
Firefox | =4.0-beta9 | |
Firefox | =4.0.1 | |
Firefox | =5.0 | |
Firefox | =5.0.1 | |
Firefox | =6.0 | |
Firefox | =6.0.1 | |
Firefox | =6.0.2 | |
Firefox | =7.0 | |
Firefox | =7.0.1 | |
Firefox | =8.0 | |
Firefox | =8.0.1 | |
Firefox | =9.0 | |
Firefox | =9.0.1 | |
Firefox | =10.0 | |
Firefox | =10.0.1 | |
Firefox | =10.0.2 | |
Firefox | =10.0.3 | |
Firefox | =10.0.4 | |
Firefox | =10.0.5 | |
Firefox | =10.0.6 | |
Firefox | =10.0.7 | |
Firefox | =10.0.8 | |
Firefox | =10.0.9 | |
Firefox | =10.0.10 | |
Firefox | =10.0.11 | |
Firefox | =10.0.12 | |
Firefox | =11.0 | |
Firefox | =12.0 | |
Firefox | =12.0-beta6 | |
Firefox | =13.0 | |
Firefox | =13.0.1 | |
Firefox | =14.0 | |
Firefox | =14.0.1 | |
Firefox | =15.0 | |
Firefox | =15.0.1 | |
Firefox | =16.0 | |
Firefox | =16.0.1 | |
Firefox | =16.0.2 | |
Firefox | =17.0 | |
Firefox | =17.0.1 | |
Firefox | =17.0.2 | |
Firefox | =17.0.3 | |
Firefox | =17.0.4 | |
Firefox | =17.0.5 | |
Firefox | =17.0.6 | |
Firefox | =17.0.7 | |
Firefox | =17.0.8 | |
Firefox | =17.0.9 | |
Firefox | =17.0.10 | |
Firefox | =17.0.11 | |
Firefox | =18.0 | |
Firefox | =18.0.1 | |
Firefox | =18.0.2 | |
Firefox | =19.0 | |
Firefox | =19.0.1 | |
Firefox | =19.0.2 | |
Firefox | =20.0 | |
Firefox | =20.0.1 | |
Firefox | =21.0 | |
Firefox | =22.0 | |
Firefox | =23.0 | |
Firefox | =23.0.1 | |
Firefox | =24.0 | |
Firefox | =24.1 | |
Firefox | =24.1.1 | |
Firefox | =25.0 | |
Firefox | =25.0.1 | |
Firefox | =26.0 | |
Firefox | =27.0 | |
Firefox | =27.0.1 | |
Firefox | =28.0 | |
Firefox | =29.0 | |
Firefox | =29.0.1 | |
Firefox | =30.0 | |
Firefox | =31.0 | |
Firefox | =31.1.0 | |
Firefox | =32.0 | |
Firefox | =33.0 | |
Firefox | =34.0.5 | |
Microsoft Windows Operating System | ||
Thunderbird | <=31.4 | |
Thunderbird | =31.0 | |
Thunderbird | =31.1.2 | |
Thunderbird | =31.2 | |
Thunderbird | =31.3 | |
Firefox ESR | =31.0 | |
Firefox ESR | =31.1 | |
Firefox ESR | =31.1.1 | |
Firefox ESR | =31.2 | |
Firefox ESR | =31.3 | |
Firefox ESR | =31.4 | |
Firefox ESR | =31.5 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2015-0833 is classified as a medium severity vulnerability due to its ability to allow local users to gain elevated privileges through a specific exploit.
To fix CVE-2015-0833, upgrade to the latest version of Mozilla Firefox or Mozilla Thunderbird that addresses this vulnerability.
CVE-2015-0833 affects Mozilla Firefox versions prior to 36.0, Firefox ESR versions before 31.5, and Thunderbird versions before 31.5 on Windows.
In the context of CVE-2015-0833, a Trojan horse DLL is a malicious dynamic link library that could be placed in untrusted directories to exploit the vulnerability.
No, local users must have physical or direct access to the affected system to exploit CVE-2015-0833.