CVE-2023-5727: Medium severity thunderbird vulnerability
The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle files, which can run commands on a user's computer. Note: This issue only affected Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 119, Firefox ESR < 115.4, and Thunderbird < 115.4.1.
Other sources
The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle files, which can run commands on a user's computer. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.
— Mozilla
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2023-5727?
CVE-2023-5727 is a vulnerability that allows the execution of commands on a user's computer without the warning prompt when downloading .msix, .msixbundle, .appx, and .appxbundle files in Firefox ESR versions 115.4 and earlier, as well as Firefox versions 119 and earlier.
How does CVE-2023-5727 affect Windows operating systems?
CVE-2023-5727 affects Windows operating systems by not presenting the executable file warning when downloading certain file types, potentially allowing malicious commands to run on a user's computer.
Which versions of Firefox are affected by CVE-2023-5727?
Firefox ESR versions 115.4 and earlier, as well as Firefox versions 119 and earlier, are affected by CVE-2023-5727.
What is the severity of CVE-2023-5727?
CVE-2023-5727 has a severity rating of medium with a CVSS score of 4.0.
How can I fix CVE-2023-5727?
To fix CVE-2023-5727, update your Firefox browser to the latest version available, which has addressed the vulnerability.