CVE-2017-7794 — Incorrect Default Permissions in Mozilla Firefox
Severity
7.8HIGHNVD
OSV9.1
EPSS
0.0%
top 86.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 11
Latest updateMay 13
Description
On Linux systems, if the content process is compromised, the sandbox broker will allow files to be truncated even though the sandbox explicitly only has read access to the local file system and no write permissions. Note: This attack only affects the Linux operating system. Other operating systems are not affected. This vulnerability affects Firefox < 55.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages4 packages
🔴Vulnerability Details
5GHSA▶
GHSA-p52p-vjgp-j832: On Linux systems, if the content process is compromised, the sandbox broker will allow files to be truncated even though the sandbox explicitly only h↗2022-05-13
OSV▶
CVE-2017-7794: On Linux systems, if the content process is compromised, the sandbox broker will allow files to be truncated even though the sandbox explicitly only h↗2017-08-10
📋Vendor Advisories
5Debian▶
CVE-2017-7794: firefox - On Linux systems, if the content process is compromised, the sandbox broker will...↗2017