CVE-2017-7760 — Improper Privilege Management in Mozilla Firefox

CWE-4173 documents3 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 66.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Mozilla FirefoxMozilla Firefox ESRDebian Firefox+1 more
Timeline
PublishedJun 11
Latest updateMay 14

Description

The Mozilla Windows updater modifies some files to be updated by reading the original file and applying changes to it. The location of the original file can be altered by a malicious user by passing a special path to the callback parameter through the Mozilla Maintenance Service, allowing the manipulation of files in the installation directory and privilege escalation by manipulating the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and …

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

▶CVEListV5mozilla/firefoxunspecified — 54
▶NVDmozilla/firefox< 52.2.0+1
▶CVEListV5mozilla/firefox_esrunspecified — 52.2

Patches

Patch: bugzilla.mozilla.org ↗Patch: bugzilla.mozilla.org ↗

🔴Vulnerability Details

1
GHSA
GHSA-v3f8-p9hj-32cj: The Mozilla Windows updater modifies some files to be updated by reading the original file and applying changes to it↗2022-05-14
▶

📋Vendor Advisories

1
Debian
CVE-2017-7760: firefox - The Mozilla Windows updater modifies some files to be updated by reading the ori...↗2017
▶