CVE-2012-4206: Mozilla Firefox

Medium severity, CVSS 6.9. EPSS: 0.3% chance of exploitation in the next 30 days.

Untrusted search path vulnerability in the installer in Mozilla Firefox before 17.0 and Firefox ESR 10.x before 10.0.11 on Windows allows local users to gain privileges via a Trojan horse DLL in the default downloads directory.

Affected products

• Mozilla Firefox: up to and including 16.0.2; version 0.1 only; version 0.2 only; version 0.3 only; version 0.4 only; version 0.5 only; …

Published 2012-11-21. Last modified 2026-06-16.