7.8high
CVE-2016-5295
This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 25%
Public exploits
0
none known
Summary
This vulnerability allows an attacker to use the Mozilla Maintenance Service to escalate privilege by having the Maintenance Service invoke the Mozilla Updater to run malicious local files. This vulnerability requires local system access and is a variant of MFSA2013-44. Note: this issue only affects Windows operating systems. This vulnerability affects Firefox < 50.
Exploit prediction (EPSS)
0.32% probability of exploitation in the next 30 days, higher than 25% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- Mozilla Firefox
Classification
- Weakness
- CWE-264 Permissions, Privileges, and Access Controls
References
- securityfocus.com /bid/94337 · vdb-entry, x_refsource_BID, x_transferred
- mozilla.org /en-US/security/advisories/mfsa2013-44/ · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1037298 · vdb-entry, x_refsource_SECTRACK, x_transferred
- mozilla.org /security/advisories/mfsa2016-89/ · x_refsource_CONFIRM, x_transferred
- bugzilla.mozilla.org /show_bug.cgi?id=1247239 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2016-5295
- NVD: CVE-2016-5295
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.