GHSA-ghmm-93ww-fvhh
Record from GitHub Advisory Database · Published May 13, 2022
Windows 10 does not warn users before opening executable files with the SettingContent-ms extension even when they have been downloaded from the internet and have the "Mark of the Web." Without the warning, unsuspecting users unfamiliar with this new file type might run an unwanted executable. This also allows a WebExtension with the limited downloads.open permission to execute arbitrary code without user interaction on Windows 10 systems. *Note: this issue only affects Windows operating systems. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 60, Thunderbird < 52.9, Firefox ESR < 60.1, Firefox ESR < 52.9, and Firefox < 61.
Risk scores
Timeline
- May 13, 2022 CVE Published
- Apr 29, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-ghmm-93ww-fvhh
vulnetix vdb fixes GHSA-ghmm-93ww-fvhhOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-ghmm-93ww-fvhh/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://www.mozilla.org/security/advisories/mfsa2018-15 url
- https://www.mozilla.org/security/advisories/mfsa2018-17 url
- https://www.mozilla.org/security/advisories/mfsa2018-19 url
- https://bugzilla.mozilla.org/show_bug.cgi?id=1468217 url
- https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39 url
- https://security.gentoo.org/glsa/201810-01 url
- http://www.securityfocus.com/bid/104560 url
- http://www.securitytracker.com/id/1041193 url
- https://nvd.nist.gov/vuln/detail/CVE-2018-12368 advisory
- https://www.mozilla.org/security/advisories/mfsa2018-16 url
- https://www.mozilla.org/security/advisories/mfsa2018-18 url