Threats tagged 'ghsa-j657-7g4v-wv6h'

Mozilla Firefox's update mechanism contained a vulnerability that allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating file-locking behavior. This flaw enabled an attacker to inject code into a user-privileged process, bypass access controls, and perform SYSTEM-level file operations on paths controlled by a non-privileged user, resulting in privilege escalation. The vulnerability affects Firefox versions prior to 138, Firefox ESR prior to 128.10, Thunderbird prior to 138, and Thunderbird ESR prior to 128.10. Mozilla has released fixes in Firefox 138 and Firefox ESR 128.10.