CVE-2016-5295

EUVD-2016-6246
This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke the Mozilla Updater to run malicious local files. This vulnerability requires local system access and is a variant of MFSA2013-44. Note: this issue only affects Windows operating systems. This vulnerability affects Firefox < 50.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 23%
Affected Products (NVD)
VendorProductVersion
mozillafirefox
𝑥
< 50.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
firefox
sid
132.0.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
precise
not-affected
trusty
dne
xenial
not-affected
yakkety
not-affected
thunderbird
precise
not-affected
trusty
dne
xenial
not-affected
yakkety
not-affected
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/94337
http://www.securitytracker.com/id/1037298
https://bugzilla.mozilla.org/show_bug.cgi?id=1247239
https://www.mozilla.org/en-US/security/advisories/mfsa2013-44/
https://www.mozilla.org/security/advisories/mfsa2016-89/
http://www.securityfocus.com/bid/94337
http://www.securitytracker.com/id/1037298
https://bugzilla.mozilla.org/show_bug.cgi?id=1247239
https://www.mozilla.org/en-US/security/advisories/mfsa2013-44/
https://www.mozilla.org/security/advisories/mfsa2016-89/