CVE-2017-7760: The Mozilla Windows updater modifies some files to be updated by reading the original file and applying changes to it. The location of the original file can be…

PriorityP335high7.8CVSS 3.0

AVLACLPRLUINSUCHIHAH

EPSS

0.41%

33.0th percentile

The Mozilla Windows updater modifies some files to be updated by reading the original file and applying changes to it. The location of the original file can be altered by a malicious user by passing a special path to the callback parameter through the Mozilla Maintenance Service, allowing the manipulation of files in the installation directory and privilege escalation by manipulating the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	firefox	—	—
debian	firefox-esr	—	—
mozilla	firefox	< 52.2.0	52.2.0
mozilla	firefox	< 54.0	54.0
mozilla	firefox	>= unspecified < 54	54
mozilla	firefox_esr	>= unspecified < 52.2	52.2

CVSS provenance

nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P

vendor_debian7.8LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.