CVE-2023-29542

2023-04-1206:31:58

redhat.com

access.redhat.com

mozilla foundation

security advisory

cve-2023-29542

firefox

windows

newline

filename

bypass

file extension

security mechanisms

malicious code

execution

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

69.9%

JSON

The Mozilla Foundation Security Advisory describes this flaw as: A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code. This bug only affects Firefox on Windows. Other versions of Firefox are unaffected.