CVE-2025-2817

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-2817
Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths controlled by a non-privileged user and enabling privilege escalation. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Firefox ESR < 115.23, Thunderbird < 138, and Thunderbird < 128.10.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://bugzilla.mozilla.org/show_bug.cgi?id=1917536 Permissions Required
https://www.mozilla.org/security/advisories/mfsa2025-28/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-29/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-30/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-31/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2025-32/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
History

13 Jun 2025, 18:53

Type Values Removed Values Added
First Time Mozilla
Mozilla firefox
Mozilla thunderbird
CPE cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:esr:*:*:*
References () https://bugzilla.mozilla.org/show_bug.cgi?id=1917536 - () https://bugzilla.mozilla.org/show_bug.cgi?id=1917536 - Permissions Required
References () https://www.mozilla.org/security/advisories/mfsa2025-28/ - () https://www.mozilla.org/security/advisories/mfsa2025-28/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2025-29/ - () https://www.mozilla.org/security/advisories/mfsa2025-29/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2025-30/ - () https://www.mozilla.org/security/advisories/mfsa2025-30/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2025-31/ - () https://www.mozilla.org/security/advisories/mfsa2025-31/ - Vendor Advisory
References () https://www.mozilla.org/security/advisories/mfsa2025-32/ - () https://www.mozilla.org/security/advisories/mfsa2025-32/ - Vendor Advisory

01 May 2025, 15:16

Type Values Removed Values Added
Summary
  • (es) El mecanismo de actualización de Mozilla Firefox permitía que un proceso de usuario de integridad media interfiriera con el actualizador a nivel de SYSTEM manipulando el comportamiento de bloqueo de archivos. Al inyectar código en el proceso con privilegios de usuario, un atacante podía eludir los controles de acceso previstos, lo que permitía operaciones con archivos a nivel de SYSTEM en rutas controladas por un usuario sin privilegios y habilitaba la escalada de privilegios. Esta vulnerabilidad afecta a Firefox &lt; 138, Firefox ESR &lt; 128.10, Firefox ESR &lt; 115.23, Thunderbird &lt; 138 y Thunderbird ESR &lt; 128.10.
Summary (en) Mozilla Firefox's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths controlled by a non-privileged user and enabling privilege escalation. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Firefox ESR < 115.23, Thunderbird < 138, and Thunderbird ESR < 128.10. (en) Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the user-privileged process, an attacker could bypass intended access controls, allowing SYSTEM-level file operations on paths controlled by a non-privileged user and enabling privilege escalation. This vulnerability affects Firefox < 138, Firefox ESR < 128.10, Firefox ESR < 115.23, Thunderbird < 138, and Thunderbird < 128.10.

29 Apr 2025, 15:15

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
CWE CWE-22

29 Apr 2025, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-04-29 14:15

Updated : 2025-06-13 18:53

NVD link : CVE-2025-2817

Mitre link : CVE-2025-2817

CVE.ORG link : CVE-2025-2817

JSON object : View

Products Affected

mozilla

  • firefox
  • thunderbird
CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')