CVE-2023-29541

HighCVSS 8.8/10Last modified Aug 19, 2026

Description

Firefox did not properly handle downloads of files ending in <code>.desktop</code>, which can be interpreted to run attacker-controlled commands. <br>*This bug only affects Firefox for Linux on certain Distributions. Other operating systems are unaffected, and Mozilla is unable to enumerate all affected Linux Distributions.*. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-116

Affected software

No affected versions have been published.

Timeline

Published: Jun 2, 2023
Last modified: Aug 19, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-295429.8A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as CVE-2023-295438.8An attacker could have caused memory corruption and a potentially exploitable use-after-free of a pointer in a global object's debugger vect CVE-2023-295446.5If multiple instances of resource exhaustion occurred at the incorrect time, the garbage collector could have caused memory corruption and a CVE-2023-295456.5Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have reso CVE-2023-295466.5When recording the screen while in Private Browsing on Firefox for Android the address bar and keyboard were not hidden, potentially leaking CVE-2023-295476.5When a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain could have been created, when it should have s CVE-2023-295486.5A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result. This vulnerability affects Firefox < 112, Fo CVE-2023-295496.5Under certain circumstances, a call to the <code>bind</code> function may have resulted in the incorrect realm. This may have created a vuln CVE-2023-29559.8A vulnerability, which was classified as critical, was found in SourceCodester Students Online Internship Timesheet System 1.0. Affected is CVE-2023-295508.8Memory safety bugs present in Firefox 111 and Firefox ESR 102.9. Some of these bugs showed evidence of memory corruption and we presume that CVE-2023-295518.8Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so CVE-2023-295527.5The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services. This could allow th