Vulnerability · Published Jun 19, 2023 · Assigned by mozilla
CVE-2023-29542
Critical 9.8
In plain English
A critical-severity security flaw in Firefox from Mozilla. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code. *This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | firefox-esr | 102.10.0-r0 | ALPINE-CVE-2023-29542 |
| Alpine:v3.21 | firefox-esr | 102.10.0-r0 | ALPINE-CVE-2023-29542 |
| Alpine:v3.22 | firefox-esr | 102.10.0-r0 | ALPINE-CVE-2023-29542 |
| Alpine:v3.23 | firefox-esr | 102.10.0-r0 | ALPINE-CVE-2023-29542 |
| Ubuntu:22.04:LTS | mozjs78 | no fix listed | UBUNTU-CVE-2023-29542 |
| Ubuntu:22.04:LTS | mozjs91 | no fix listed | UBUNTU-CVE-2023-29542 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | unspecified – before 112 |
| Mozilla | Firefox ESR | unspecified – before 102.10 |
| Mozilla | Thunderbird | unspecified – before 102.10 |