Описание
After selecting a malicious Windows .url shortcut from the local filesystem, an unexpected file could be uploaded.
This bug only affects Firefox on Windows. Other operating systems are unaffected.. This vulnerability was fixed in Firefox 137 and Thunderbird 137.
Ссылки
- Issue TrackingPermissions Required
- Vendor Advisory
- Vendor Advisory
Уязвимые конфигурации
Одно из
EPSS
7.7 High
CVSS3
Дефекты
Связанные уязвимости
After selecting a malicious Windows `.url` shortcut from the local filesystem, an unexpected file could be uploaded. *This bug only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 137 and Thunderbird 137.
After selecting a malicious Windows `.url` shortcut from the local fil ...
After selecting a malicious Windows `.url` shortcut from the local filesystem, an unexpected file could be uploaded. *This bug only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 137 and Thunderbird < 137.
Уязвимость браузера Mozilla Firefox и почтового клиента Thunderbird, позволяющая нарушителю выполнить произвольный код
ALT-PU-2025-6353: package `firefox` update to version 138.0.1-alt1
EPSS
7.7 High
CVSS3