Insecure DLL library loading in Firefox ESR - CVE-2017-7755

Vulnerability identifier: #VU7069

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-7755

CWE-ID: CWE-426

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain elevated privileges on the target system.

The vulnerability exists due to insecure .dll loading mechanism when opening files. A remote attacker can place a specially crafted .dll file along with installer on a remote SBM or WebDAV share, trick the victim into running the installer file from this directory and execute arbitrary code on the target system with privileges of the current victim.

Successful exploitation of the vulnerability may result in system compromise.

Firefox ESR
Mozilla Firefox
SUSE Linux
Opensuse

Update to version 52.2.

Firefox ESR - update to 52.2.0
Mozilla Firefox - update to 54.0

• https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/

• openSUSE update for Mozilla
• SUSE Linux update for MozillaFirefox
• SUSE Linux update for MozillaFirefox
• Multiple vulnerabilities in Firefox ESR
• Multiple vulnerabilities in Mozilla Firefox