Security restrictions bypass in Mozilla Firefox - CVE-2017-16541

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU14638

Security restrictions bypass in Mozilla Firefox - CVE-2017-16541

Published: September 6, 2018


Vulnerability identifier: #VU14638
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-16541
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass security restrictions on the target system.

The vulnerability exists due to content can be loaded from the mounted file system directly using a file: URI. A remote unauthenticated attacker can use the automount feature with autofs to create a mount point on the local file system and bypass browser proxy settings.


Affected software

Mozilla Firefox
Firefox ESR
Gentoo Linux
Debian Linux
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Power
Opensuse
Mozilla Thunderbird

How to mitigate CVE-2017-16541

Update to version 62.0.

Mozilla Firefox - update to 62.0
Firefox ESR - update to 60.2.0
Mozilla Thunderbird - update to 60.2.1

External References

Related Security Bulletins