The host is installed with Mozilla firefox and is prone to untrusted search path vulnerability.

Successful exploitation will let attackers to execute arbitrary code in the context of the affected application. Impact Level: System/Application

Upgrade to Mozilla Firefox version 3.6.20 or later, For updates refer to http://www.mozilla.com/en-US/firefox/all.html

The flaw is due to error in 'ThinkPadSensor::Startup' allows local users to gain privileges by leveraging write access in an unspecified directory to place a Trojan horse DLL that is loaded into the running Firefox process.

Mozilla Firefox version before 3.6.20

• http://www.mozilla.org/security/announce/2011/mfsa2011-30.html

---

Updated on 2015-03-25