CVE-2015-4505

Published Sep 24, 2015

Last updated 4 months ago

Overview

Description
updater.exe in Mozilla Firefox before 41.0 and Firefox ESR 38.x before 38.3 on Windows allows local users to write to arbitrary files by conducting a junction attack and waiting for an update operation by the Mozilla Maintenance Service.
Source
security@mozilla.org
NVD status
Modified

Risk scores

CVSS 2.0

Type
Primary
Base score
6.6
Impact score
9.2
Exploitability score
3.9
Vector string
AV:L/AC:L/Au:N/C:N/I:C/A:C

Weaknesses

nvd@nist.gov
CWE-264

Social media

Hype score
Not currently trending

Configurations