Multiple Mozilla products contain a flaw that is triggered when a specially crafted executable is installed on the root partition of a Windows file system. This may allow an attacker to cause the installer to run this executable with the user's permissions instead of the Mozilla product.

Upgrade Firefox and Thunderbird to version 15 or higher (10.0.7 for ESR), as they have been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1027450 1027452
• CVE ID: 2012-3974 (see also: NVD)
• Secunia Advisory ID: 50088 50308 50437 50616 52429
• Bugtraq ID: 55312
• Vendor Specific News/Changelog Entry: http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00011.html
  http://lists.opensuse.org/opensuse-security-announce/2012-09/msg00014.html
  http://www.palemoon.org/releasenotes-ng.shtml
  https://bugzilla.mozilla.org/show_bug.cgi?id=770478 [ Auth Req'd ]
• Vendor Specific Advisory URL: http://rss.xerox.com/~r/security-bulletins/~5/LLTGnhmbIMY/cert_XRX13-004_v1.01.pdf
  http://rss.xerox.com/~r/security-bulletins/~5/xzeGn6t7q7c/cert_XRX13-003_v1.0.pdf
  http://www.mozilla.org/security/announce/2012/mfsa2012-67.html
  http://www.xerox.com/download/security/security-bulletin/16287-4d6b7b0c81f7b/cert_XRX13-003_v1.0.pdf

• Masato Kinugawa