description: The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Thunderbird < 45.5, Firefox ESR < 45.5, and Firefox < 50.
problem types: Arbitrary target directory for result files of update process
affected:
{
product: Thunderbird
vendor: Mozilla
versions:
lessThan: 45.5, status: affected, version: unspecified, versionType: custom
}
{
product: Firefox ESR
vendor: Mozilla
versions:
lessThan: 45.5, status: affected, version: unspecified, versionType: custom
}
{
product: Firefox
vendor: Mozilla
versions:
lessThan: 50, status: affected, version: unspecified, versionType: custom
}
