← Back

CVE-2022-26386

nvd nist
Published: Dec 22, 2022Modified: Apr 15, 2025

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

Previously Firefox for macOS and Linux would download temporary files to a user-specific directory in <code>/tmp</code>, but this behavior was changed to download them to <code>/tmp</code> where they could be affected by other local users. This behavior was reverted to the original, user-specific directory. <br>*This bug only affects Firefox for macOS and Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox ESR < 91.7 and Thunderbird < 91.7.

Affected (2)

Mozilla
2 products
Firefox Esr
Thunderbird
Configuration A
2 vulnerable · 2 platform
Vulnerable SoftwareAffected Versions
Firefox Esr
Before 91.7
Thunderbird
Before 91.7
Running on/withPlatform Versions
Apple
Macos
All versions
Linux
Linux Kernel
All versions

Related CWEs

CWE-377
Insecure Temporary File
Creating and using insecure temporary files can leave application and system data vulnerable to attack.

References (6)

Source: security@mozilla.org
ExploitIssue TrackingVendor Advisory
Source: security@mozilla.org
Vendor Advisory
Source: security@mozilla.org
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.