Security Vulnerabilities fixed in Firefox 21

Description

Security researcher Robert Kugler discovered that in some instances the Mozilla Maintenance Service on Windows will be vulnerable to some previously fixed privilege escalation attacks that allowed for local privilege escalation. This was caused by the Mozilla Updater not updating Windows Registry entries for the Mozilla Maintenance Service, which fixed the earlier issues present if Firefox 12 had been installed. New installations of Firefox after version 12 are not affected by this issue. Local file system access is necessary in order for this issue to be exploitable and it cannot be triggered through web content.

Affected Applications

Firefox

CVE References

CVE-2013-1673 CVE-2012-1942

Other References

https://www.mozilla.org/en-US/security/advisories/mfsa2013-45