Mozilla Thunderbird and Firefox Privilege Escalation Vulnerability via Update Mechanism

A privilege escalation vulnerability has been identified in Mozilla Thunderbird and Firefox. The issue arises from the update mechanism, which allows a medium-integrity user process to disrupt the SYSTEM-level updater by manipulating file-locking behavior. This exploitation could enable an attacker to inject code into the user-privileged process, bypassing access controls and facilitating SYSTEM-level file operations on paths managed by a non-privileged user. As a result, this vulnerability could be exploited to escalate privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing a user to gain elevated rights on the system.

Remediation

Users can update to Thunderbird 138 or Firefox 138. For Firefox ESR users, the update to version 128.10 is recommended.