| Package | Affected versions | Patched versions |
|---|---|---|
| firefox | < 66.0 | 66.0 |
| firefox esr | < 60.6 | 60.6 |
| thunderbird | < 60.6 | 60.6 |
Firefox will accept any registered Program ID as an external protocol handler and offer to launch this local application when given a matching URL on Windows operating systems. This should only happen if the program has specifically registered itself as a "URL Handler" in the Windows registry. *Note: This issue only affects Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60.6, Firefox ESR < 60.6, and Firefox < 66.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free