CVE-2017-7767

published 2018-06-11

CVE-2017-7767: The Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary files with junk data using the Mozilla Windows Updater, which…

Priority P4 23 medium 5.5 CVSS 3.0

AV L AC L PR L UI N S U C N I H A N

The Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary files with junk data using the Mozilla Windows Updater, which runs with the Maintenance Service's privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	firefox	—	—
debian	firefox-esr	—	—
mozilla	firefox	< 52.2.0	52.2.0
mozilla	firefox	< 54.0	54.0
mozilla	firefox	>= unspecified < 54	54
mozilla	firefox_esr	>= unspecified < 52.2	52.2

CVSS provenance

nvd v3.0 5.5 MEDIUM CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

nvd v2.0 2.1 LOW AV:L/AC:L/Au:N/C:N/I:P/A:N

vendor_debian 5.5 LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-269