CVE-2023-29539

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 112 Focus for Android versions prior to 112 Firefox ESR versions prior to 102.10 Firefox for Android versions prior to 112 Thunderbird versions prior to 102.10

Description The issue arises from improper handling of the filename directive in the Content-Disposition header, specifically when the filename contains a NULL character, leading to filename truncation. This could facilitate reflected file download attacks, potentially tricking users into installing malware.

Recommendations For Firefox versions prior to 112, update to version 112 or later. For Focus for Android versions prior to 112, update to version 112 or later. For Firefox ESR versions prior to 102.10, update to version 102.10 or later. For Firefox for Android versions prior to 112, update to version 112 or later. For Thunderbird versions prior to 102.10, update to version 102.10 or later.