medium
5.5
Advisory Published
CVE Published
Updated

CVE-2023-29532

First published: Tue Apr 11 2023(Updated: )

A local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file by pointing the service at an update file on a malicious SMB server. The update file can be replaced after the signature check, before the use, because the write-lock requested by the service does not work on a SMB server. *Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.

Credit: security@mozilla.org

Affected SoftwareAffected VersionHow to fix
Mozilla Firefox ESR<102.10
102.10
Mozilla Firefox<112
112
All of
Mozilla Firefox=112
Google Android
All of
Mozilla Focus=112
Google Android
<102.10
102.10
<102.10
102.10
Mozilla Firefox<112.0
Mozilla Firefox ESR<102.10
Mozilla Thunderbird<102.10
Microsoft Windows

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Peer vulnerabilities

(Found alongside the following vulnerabilities)

Frequently Asked Questions

  • What is CVE-2023-29532?

    CVE-2023-29532 refers to a vulnerability where a local attacker can trick the Mozilla Maintenance Service into applying an unsigned update file.

  • How does CVE-2023-29532 work?

    CVE-2023-29532 works by the attacker pointing the Mozilla Maintenance Service at an update file on a malicious SMB server and replacing the update file after the signature check.

  • Which software is affected by CVE-2023-29532?

    Firefox ESR versions up to 102.10, Thunderbird versions up to 102.10, Firefox versions up to 112, and Firefox for Android versions up to 112 are affected by CVE-2023-29532.

  • What is the severity of CVE-2023-29532?

    CVE-2023-29532 has a severity value of 7, which is classified as high.

  • How can I mitigate the vulnerability CVE-2023-29532?

    To mitigate CVE-2023-29532, it is recommended to update to the fixed version of the affected software.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203