CVE-2015-2720

Publication date 14 May 2015

Last updated 24 July 2024

Ubuntu priority

Description

The update implementation in Mozilla Firefox before 38.0 on Windows does not ensure that the pathname for updater.exe corresponds to the application directory, which might allow local users to gain privileges via a Trojan horse file.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
firefox	15.04 vivid	Not affected
	14.10 utopic	Not affected
	14.04 LTS trusty	Not in release
	12.04 LTS precise	Not affected

How can I get the fixes?
What do statuses mean?

Notes

chrisccoulson

Affects Firefox on Windows only

References

MITRE
NVD
Launchpad
Debian

Other references

https://www.mozilla.org/en-US/security/advisories/mfsa2015-58/
https://www.cve.org/CVERecord?id=CVE-2015-2720