CVE-2015-2720

EPSS 0.08%
Published 14.05.2015 10:59:11
Last modified 12.04.2025 10:46:40
Source security@mozilla.org
Teams watchlist Login
Open Login

The update implementation in Mozilla Firefox before 38.0 on Windows does not ensure that the pathname for updater.exe corresponds to the application directory, which might allow local users to gain privileges via a Trojan horse file.

Affected products Warnungen 0 Metrics 2 CWE 0 References 7

Data is provided by the National Vulnerability Database (NVD)

Mozilla ≫ Firefox Version <= 37.0.2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.08%	0.234

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	4.4	3.4	6.4	AV:L/AC:M/Au:N/C:P/I:P/A:P

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

http://www.securityfocus.com/bid/74611

http://www.mozilla.org/security/announce/2015/mfsa2015-58.html

https://bugzilla.mozilla.org/show_bug.cgi?id=1127481

https://nvd.nist.gov/vuln/detail/CVE-2015-2720

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2015-2720

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2015-2720

EUVD