DEBIAN-CVE-2023-29541
- Source
- https://security-tracker.debian.org/tracker/CVE-2023-29541
- Import Source
- https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-29541.json
- JSON Data
- https://api.osv.dev/v1/vulns/DEBIAN-CVE-2023-29541
- Upstream
- Downstream
- Published
- 2023-06-02T17:15:12Z
- Modified
- 2026-09-15T09:01:48Z
- Severity
-
- 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
Firefox did not properly handle downloads of files ending in
.desktop, which can be interpreted to run attacker-controlled commands.
This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10. - References
Affected packages
Debian:12
firefox-esr
Package
- Name
- firefox-esr
- Purl
- pkg:deb/debian/firefox-esr?arch=source&distro=bookworm
thunderbird
Package
- Name
- thunderbird
- Purl
- pkg:deb/debian/thunderbird?arch=source&distro=bookworm
Debian:13
firefox-esr
Package
- Name
- firefox-esr
- Purl
- pkg:deb/debian/firefox-esr?arch=source&distro=trixie
thunderbird
Package
- Name
- thunderbird
- Purl
- pkg:deb/debian/thunderbird?arch=source&distro=trixie
Debian:14
firefox-esr
Package
- Name
- firefox-esr
- Purl
- pkg:deb/debian/firefox-esr?arch=source&distro=forky
thunderbird
Package
- Name
- thunderbird
- Purl
- pkg:deb/debian/thunderbird?arch=source&distro=forky