Critical · published June 19, 2023
🚨 A sneaky newline character in a filename could trick Firefox and Thunderbird into executing malicious code! 🔥 Think of it like a restaurant menu that has a hidden extra item at the bottom — you order the safe dish, but that sneaky newline lets the waiter serve you something entirely different and dangerous! This vulnerability could allow an attacker to bypass file extension protections, leading to full execution of malicious code when unsuspecting users open what they think is a safe file. The consequences could be absolutely devastating, potentially compromising sensitive information or resulting in system takeovers.
Think of it like a restaurant menu that has a hidden extra item at the bottom — you order the safe dish, but that sneaky newline lets the waiter serve you something entirely different and dangerous! CVE-2023-29542 exploits a flaw in Firefox and Thunderbird on Windows where a newline in a filename bypasses security measures that rename malicious file extensions, like .lnk to .download, thus allowing harmful code to execute.
This vulnerability could allow an attacker to bypass file extension protections, leading to full execution of malicious code when unsuspecting users open what they think is a safe file. The consequences could be absolutely devastating, potentially compromising sensitive information or resulting in system takeovers. To protect yourself, immediately update Firefox to version 112 or later and Thunderbird to version 102.10 or later. If you're an enterprise user, ensure your Firefox ESR is also updated to these versions. Don’t wait! You’ve got this! Stay proactive to keep your systems secure! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mozilla/firefox | < 112.0 | 112.0 |
| mozilla/firefox_esr | < 102.10 | 102.10 |
| mozilla/thunderbird | < 102.10 | 102.10 |