CVE-2023-29542
Full vulnerability record from the local CVENow database.
Description
A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code. *This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.
Severity
CRITICAL
CVSS score
9.8
(v3.1)
Vulnerability status
Modified
Source identifier
Published
2023-06-19 11:15:09.847000
Last modified
2026-10-23 23:10:00.157000
View original CVE JSON
{
"id": "CVE-2023-29542",
"sourceIdentifier": "[email protected]",
"published": "2023-06-19T11:15:09.847",
"lastModified": "2026-10-23T23:10:00.157",
"vulnStatus": "Modified",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code.\n\n*This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.\n\n"
},
{
"lang": "es",
"value": "Un salto de línea en un nombre de archivo podría haberse utilizado para eludir los mecanismos de seguridad de la extensión de archivo que reemplazan extensiones de archivo maliciosas como '.lnk' por '.download'. Esto podría haber llevado a la ejecución accidental de código malicioso.\n\n*Este error solo afecta a Firefox y Thunderbird en Windows. Otras versiones de Firefox y Thunderbird no se ven afectadas.* Esta vulnerabilidad afecta a Firefox < 112, Firefox ESR anterior a 102.10 y a Thunderbird anterior a 102.10."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Mozilla",
"product": "Firefox",
"defaultStatus": "unaffected",
"versions": [
{
"version": "unspecified",
"lessThan": "112",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Mozilla",
"product": "Firefox ESR",
"defaultStatus": "unaffected",
"versions": [
{
"version": "unspecified",
"lessThan": "102.10",
"versionType": "custom",
"status": "affected"
}
]
},
{
"vendor": "Mozilla",
"product": "Thunderbird",
"defaultStatus": "unaffected",
"versions": [
{
"version": "unspecified",
"lessThan": "102.10",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2024-12-11T15:45:52.899951Z",
"id": "CVE-2023-29542",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"configurations": [
{
"operator": "AND",
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
"versionEndExcluding": "112.0",
"matchCriteriaId": "8C6578F4-B46C-473F-8A17-CA6026C32FBE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*",
"versionEndExcluding": "102.10",
"matchCriteriaId": "03736567-251A-4F75-992E-AB7C957FB587"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
"versionEndExcluding": "102.10",
"matchCriteriaId": "7C8C9D9E-9BDA-475D-B7D6-10D1C6E9DD72"
}
]
},
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": false,
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
}
]
}
]
}
],
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1810793",
"source": "[email protected]",
"tags": [
"Permissions Required"
]
},
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1815062",
"source": "[email protected]",
"tags": [
"Permissions Required"
]
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2023-13/",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2023-14/",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2023-15/",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1810793",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required"
]
},
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1815062",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required"
]
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2023-13/",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2023-14/",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2023-15/",
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
]
}
]
}