CVE-2023-29545
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing...
6.5 MediumFix available
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user.
This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected. This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
0.58%Up 0.5 points since Jun 20, 2023
What each source reports
NVD Score used
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user.
This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected. This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.
- Record
CVE-2023-29545- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
CVE List
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user.
This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected. This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.
- Record
CVE-2023-29545- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
EUVDEUVD-2023-33087
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user.
This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected. This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.
- Record
EUVD-2023-33087- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xhrg-vc2x-xrcj
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing...
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user.
This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected. This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.
- Record
GHSA-xhrg-vc2x-xrcj- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVALPINE-CVE-2023-29545
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user.
This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected. This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.
- Record
ALPINE-CVE-2023-29545- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
OSVUBUNTU-CVE-2023-29545
Similar to CVE-2023-28163, this time when choosing 'Save Link As', suggested filenames containing environment variable names would have resolved those in the context of the current user. This bug only affects Firefox and Thunderbird on Windows. Other versions of Firefox and Thunderbird are unaffected. This vulnerability affects Firefox < 112, Firefox ESR < 102.10, and Thunderbird < 102.10.
- Record
UBUNTU-CVE-2023-29545- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 8 moreShow less
OSVopenSUSE-SU-2024:12852-1 No score
MozillaThunderbird-102.10.0-1.1 on GA media
These are all security issues fixed in the MozillaThunderbird-102.10.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12852-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12856-1 No score
libmozjs-102-0-102.10.0-1.1 on GA media
These are all security issues fixed in the libmozjs-102-0-102.10.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12856-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12882-1 No score
MozillaFirefox-112.0.1-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-112.0.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12882-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14572-1 No score
firefox-esr-128.5.1-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.5.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14572-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:1817-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 102.10.0 ESR (bsc#1210212)
- CVE-2023-29531: Out-of-bound memory access in WebGL on macOS
- CVE-2023-29532: Mozilla Maintenance Service Write-lock bypass
- CVE-2023-29533: Fullscreen notification obscured
- MFSA-TMP-2023-0001: Double-free in libwebp
- CVE-2023-29535: Potential Memory Corruption following Garbage Collector compaction
- CVE-2023-29536: Invalid free from JavaScript code
- CVE-2023-29539: Content-Disposition filename truncation leads to Reflected File Download
- CVE-2023-29541: Files with malicious extensions could have been downloaded unsafely on Linux
- CVE-2023-29542: Bypass of file download extension restrictions
- CVE-2023-29545: Windows Save As dialog resolved environment variables
- CVE-2023-1945: Memory Corruption in Safe Browsing Code
- CVE-2023-29548: Incorrect optimization result on ARM64
- CVE-2023-29550: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10
- Record
SUSE-SU-2023:1817-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:1819-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 102.10.0 ESR (bsc#1210212)
- CVE-2023-29531: Out-of-bound memory access in WebGL on macOS
- CVE-2023-29532: Mozilla Maintenance Service Write-lock bypass
- CVE-2023-29533: Fullscreen notification obscured
- MFSA-TMP-2023-0001: Double-free in libwebp
- CVE-2023-29535: Potential Memory Corruption following Garbage Collector compaction
- CVE-2023-29536: Invalid free from JavaScript code
- CVE-2023-29539: Content-Disposition filename truncation leads to Reflected File Download
- CVE-2023-29541: Files with malicious extensions could have been downloaded unsafely on Linux
- CVE-2023-29542: Bypass of file download extension restrictions
- CVE-2023-29545: Windows Save As dialog resolved environment variables
- CVE-2023-1945: Memory Corruption in Safe Browsing Code
- CVE-2023-29548: Incorrect optimization result on ARM64
- CVE-2023-29550: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10
- Record
SUSE-SU-2023:1819-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:1855-1 No score
Security update for MozillaFirefox
This update for MozillaFirefox fixes the following issues:
- Firefox Extended Support Release 102.10.0 ESR (bsc#1210212)
- CVE-2023-29531: Out-of-bound memory access in WebGL on macOS
- CVE-2023-29532: Mozilla Maintenance Service Write-lock bypass
- CVE-2023-29533: Fullscreen notification obscured
- MFSA-TMP-2023-0001: Double-free in libwebp
- CVE-2023-29535: Potential Memory Corruption following Garbage Collector compaction
- CVE-2023-29536: Invalid free from JavaScript code
- CVE-2023-29539: Content-Disposition filename truncation leads to Reflected File Download
- CVE-2023-29541: Files with malicious extensions could have been downloaded unsafely on Linux
- CVE-2023-29542: Bypass of file download extension restrictions
- CVE-2023-29545: Windows Save As dialog resolved environment variables
- CVE-2023-1945: Memory Corruption in Safe Browsing Code
- CVE-2023-29548: Incorrect optimization result on ARM64
- CVE-2023-29550: Memory safety bugs fixed in Firefox 112 and Firefox ESR 102.10
- Record
SUSE-SU-2023:1855-1- Updated
- 2026-11-02
OSVSUSE-SU-2023:2064-1 No score
Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues:
Update to Mozilla Thunderbird 102.10.1 (MFSA 2023-15) (bsc#1210212):
Security fixes:
- CVE-2023-29531: Out-of-bound memory access in WebGL on macOS (bmo#1794292)
- CVE-2023-29532: Mozilla Maintenance Service Write-lock bypass (bmo#1806394)
- CVE-2023-29533: Fullscreen notification obscured (bmo#1798219, bmo#1814597)
- CVE-2023-1999: Double-free in libwebp (bmo#1819244)
- CVE-2023-29535: Potential Memory Corruption following Garbage Collector compaction (bmo#1820543)
- CVE-2023-29536: Invalid free from JavaScript code (bmo#1821959)
- CVE-2023-0547: Revocation status of S/Mime recipient certificates was not checked (bmo#1811298)
- CVE-2023-29479: Hang when processing certain OpenPGP messages (bmo#1824978)
- CVE-2023-29539: Content-Disposition filename truncation leads to Reflected File Download (bmo#1784348)
- CVE-2023-29541: Files with malicious extensions could have been downloaded unsafely on Linux (bmo#1810191)
- CVE-2023-29542: Bypass of file download extension restrictions (bmo#1810793, bmo#1815062)
- CVE-2023-29545: Windows Save As dialog resolved environment variables (bmo#1823077)
- CVE-2023-1945: Memory Corruption in Safe Browsing Code (bmo#1777588)
- CVE-2023-29548: Incorrect optimization result on ARM64 (bmo#1822754)
- CVE-2023-29550: Memory safety bugs fixed in Thunderbird 102.10 (bmo#1720594, bmo#1751945, bmo#1812498, bmo#1814217, bmo#1818357, bmo#1818762, bmo#1819493, bmo#1820389, bmo#1820602, bmo#1821448, bmo#1822413, bmo#1824828)
Other fixes:
- fixed: Messages with missing or corrupt 'From:' header did not display message header buttons (bmo#1793918)
- fixed: Composer repeatedly prompted for S/MIME smartcard signing/encryption password (bmo#1828366)
- fixed: Address Book integration did not work with macOS 11.4 Bug Sur (bmo#1720257)
- fixed: Mexico City DST fix in Thunderbird 102.10.0 (bug 1826146) was incomplete (bmo#1827503)
- changed: New messages will automatically select S/MIME if configured and OpenPGP is not (bmo#1793278)
- fixed: Calendar events with timezone America/Mexico_City incorrectly applied Daylight Savings Time (bmo#1826146)
- fixed: Security fixes
- Record
SUSE-SU-2023:2064-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
firefox-esrAlpine:v3.18 |
before 102.10.0-r0 | 102.10.0-r0 |
firefox-esrAlpine:v3.19 |
before 102.10.0-r0 | 102.10.0-r0 |
firefox-esrAlpine:v3.20 |
before 102.10.0-r0 | 102.10.0-r0 |
firefox-esrAlpine:v3.21 |
before 102.10.0-r0 | 102.10.0-r0 |
firefox-esrAlpine:v3.22 |
before 102.10.0-r0 | 102.10.0-r0 |
firefox-esrAlpine:v3.23 |
before 102.10.0-r0 | 102.10.0-r0 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS From an advisory covering 12 CVEs |
before 102.10.0-150000.150.82.1 | 102.10.0-150000.150.82.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP1-LTSS From an advisory covering 12 CVEs |
before 102.10.0-150000.150.82.1 | 102.10.0-150000.150.82.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP1 From an advisory covering 12 CVEs |
before 102.10.0-150000.150.82.1 | 102.10.0-150000.150.82.1 |
MozillaFirefoxSUSE:OpenStack Cloud 9 From an advisory covering 12 CVEs |
before 102.10.0-112.156.1 | 102.10.0-112.156.1 |
Show 32 moreShow less
| Package | Affected | Fixed |
|---|---|---|
MozillaFirefoxSUSE:OpenStack Cloud Crowbar 9 From an advisory covering 12 CVEs |
before 102.10.0-112.156.1 | 102.10.0-112.156.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 12 CVEs |
before 102.10.0-112.156.1 | 102.10.0-112.156.1 |
MozillaFirefoxSUSE:Linux Enterprise Software Development Kit 12 SP5 From an advisory covering 12 CVEs |
before 102.10.0-112.156.1 | 102.10.0-112.156.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 12 CVEs |
before 102.10.0-112.156.1 | 102.10.0-112.156.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP4-ESPOS From an advisory covering 12 CVEs |
before 102.10.0-112.156.1 | 102.10.0-112.156.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP4-LTSS From an advisory covering 12 CVEs |
before 102.10.0-112.156.1 | 102.10.0-112.156.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 12 CVEs |
before 102.10.0-112.156.1 | 102.10.0-112.156.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 12 CVEs |
before 102.10.0-112.156.1 | 102.10.0-112.156.1 |
MozillaFirefoxSUSE:Linux Enterprise Module for Desktop Applications 15 SP4 From an advisory covering 12 CVEs |
before 102.10.0-150200.152.84.1 | 102.10.0-150200.152.84.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS From an advisory covering 12 CVEs |
before 102.10.0-150200.152.84.1 | 102.10.0-150200.152.84.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS From an advisory covering 12 CVEs |
before 102.10.0-150200.152.84.1 | 102.10.0-150200.152.84.1 |
MozillaFirefoxSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS From an advisory covering 12 CVEs |
before 102.10.0-150200.152.84.1 | 102.10.0-150200.152.84.1 |
MozillaFirefoxSUSE:Linux Enterprise Real Time 15 SP3 From an advisory covering 12 CVEs |
before 102.10.0-150200.152.84.1 | 102.10.0-150200.152.84.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP2-LTSS From an advisory covering 12 CVEs |
before 102.10.0-150200.152.84.1 | 102.10.0-150200.152.84.1 |
MozillaFirefoxSUSE:Linux Enterprise Server 15 SP3-LTSS From an advisory covering 12 CVEs |
before 102.10.0-150200.152.84.1 | 102.10.0-150200.152.84.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP2 From an advisory covering 12 CVEs |
before 102.10.0-150200.152.84.1 | 102.10.0-150200.152.84.1 |
MozillaFirefoxSUSE:Linux Enterprise Server for SAP Applications 15 SP3 From an advisory covering 12 CVEs |
before 102.10.0-150200.152.84.1 | 102.10.0-150200.152.84.1 |
MozillaFirefoxSUSE:Enterprise Storage 7 From an advisory covering 12 CVEs |
before 102.10.0-150200.152.84.1 | 102.10.0-150200.152.84.1 |
MozillaFirefoxSUSE:Enterprise Storage 7.1 From an advisory covering 12 CVEs |
before 102.10.0-150200.152.84.1 | 102.10.0-150200.152.84.1 |
MozillaFirefoxopenSUSE:Leap 15.4 From an advisory covering 12 CVEs |
before 102.10.0-150200.152.84.1 | 102.10.0-150200.152.84.1 |
MozillaThunderbirdSUSE:Linux Enterprise Module for Package Hub 15 SP4 From an advisory covering 15 CVEs |
before 102.10.1-150200.8.113.2 | 102.10.1-150200.8.113.2 |
MozillaThunderbirdSUSE:Linux Enterprise Workstation Extension 15 SP4 From an advisory covering 15 CVEs |
before 102.10.1-150200.8.113.2 | 102.10.1-150200.8.113.2 |
MozillaThunderbirdopenSUSE:Leap 15.4 From an advisory covering 15 CVEs |
before 102.10.1-150200.8.113.2 | 102.10.1-150200.8.113.2 |
mozjs52Ubuntu:18.04:LTS |
All versions, plus listed versions 52.3.1-0ubuntu352.3.1-7fakesync152.8.1-0ubuntu0.18.04.152.9.1-0ubuntu0.18.04.1 |
None known |
mozjs38Ubuntu:18.04:LTS |
All versions, plus listed versions 38.8.0~repack1-0ubuntu138.8.0~repack1-0ubuntu338.8.0~repack1-0ubuntu4 |
None known |
mozjs68Ubuntu:20.04:LTS |
All versions, plus listed versions 68.5.0-1~fakesync68.5.0-2~fakesync68.6.0-168.6.0-1ubuntu1 |
None known |
mozjs52Ubuntu:20.04:LTS |
All versions, plus listed versions 52.9.1-1build152.9.1-1ubuntu3 |
None known |
mozjs78Ubuntu:22.04:LTS |
All versions, plus listed versions 78.13.0-178.15.0-278.15.0-4ubuntu1 |
None known |
mozjs91Ubuntu:22.04:LTS |
All versions, plus listed versions 91.5.1-0ubuntu191.6.0-191.6.0-291.7.0-291.10.0-0ubuntu1 |
None known |
MozillaThunderbirdopenSUSE:Tumbleweed From an advisory covering 15 CVEs |
before 102.10.0-1.1 | 102.10.0-1.1 |
MozillaFirefoxopenSUSE:Tumbleweed From an advisory covering 21 CVEs |
before 112.0.1-1.1 | 112.0.1-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 1860 CVEs |
before 128.5.1-1.1 | 128.5.1-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-29545 is a medium vulnerability (CVSS 6.5) in Mozilla Firefox, published April 11, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.58%, the 48th percentile. Fixed in firefox-esr 102.10.0-r0.
References
bugzilla.mozilla.org/show_bug.cgi?id=1823077
mozilla.org/security/advisories/mfsa2023-13
nvd.nist.gov/vuln/detail/CVE-2023-29545
github.com/advisories/GHSA-xhrg-vc2x-xrcj
Show 194 moreShow less
security.alpinelinux.org/vuln/CVE-2023-29545
suse.com/support/update/announcement/2023/suse-su-20231817-1
bugzilla.suse.com/1210212
ubuntu.com/security/CVE-2023-29545
cve.org/CVERecord?id=CVE-2023-29545
lists.opensuse.org/archives/list/[email protected]/thread/3HI2RC7AJAHY74Q6MK7GNGWU6TITB22V
This page doesn't list everything
Left out here: 1,683 references. The JSON record has them.