Filename Handling Flaw in Mozilla Products Exposes Users to Security Risks
CVE-2023-29539

8.8HIGH

Key Information:

Vendor

Mozilla
Status
Firefox
Focus for Android
Firefox ESR
Firefox for Android
Vendor
CVE Published:
2 June 2023

What is CVE-2023-29539?

A vulnerability exists in various Mozilla products related to the handling of the filename directive within the Content-Disposition header. If a filename contains a NULL character, it is truncated, which may lead to reflected file download attacks. This could potentially deceive users into unknowingly installing malicious software. Users of affected versions of Firefox, Thunderbird, and Focus for Android should be aware of this security concern and take necessary precautions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Firefox < 112

Firefox ESR < 102.10

Firefox for Android < 112

References

https://www.mozilla.org/security/advisories/mfsa2023-15/
https://www.mozilla.org/security/advisories/mfsa2023-14/
https://www.mozilla.org/security/advisories/mfsa2023-13/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.