Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 12:13:21 +0000 CVE-2025-2817 — Privilege escalation in Thunderbird Updater https://vulnerability.circl.lu/vuln/cve-2025-2817 <p><strong>Affected:</strong> Mozilla Firefox, Mozilla Thunderbird</p> <p>Thunderbird&#39;s update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths controlled by a non-privileged user and enabling privilege escalation. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10.</p> <p><strong>Affected:</strong> Mozilla Firefox, Mozilla Thunderbird</p> <p>Thunderbird&#39;s update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths controlled by a non-privileged user and enabling privilege escalation. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10.</p> https://vulnerability.circl.lu/vuln/cve-2025-2817