Skip to content
fr Sign in
9.8 Critical

CVE-2023-29542 A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious…

Description

A newline in a filename could have been used to bypass the file extension security mechanisms that replace malicious file extensions such as .lnk with .download. This could have led to accidental execution of malicious code. *This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected.* This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.

Affected products and versions

Product Affected versions Fixed in
Firefox 112 earliest → < 112 112
Firefox ESR 102.10 earliest → < 102.10 102.10
Thunderbird 102.10 earliest → < 102.10 102.10

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Firefox

The 2221 CVEs of Firefox →
CVE-2026-120572 Incorrect boundary conditions in the Layout: Block and Inline component 8.8 High CVE-2026-118027 Frame poisoning in the Layout component 9.1 Critical CVE-2026-118025 Other issue in the SVG component 8.8 High CVE-2026-118026 Invalid pointer in the JavaScript: GC component 8.8 High
Track this CVE