Insecure DLL library loading in Firefox ESR - CVE-2017-7761

Vulnerability identifier: #VU7074

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-7761

CWE-ID: CWE-427

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists in the Mozilla Maintenance Service helper.exe application due to insecure .dll loading mechanism when opening files. A local attacker can place a specially crafted .dll file along with junction protected files on a remote SBM or WebDAV share, trick the victim into opening legitimate media file and execute arbitrary code on the target system with system privileges.

Successful exploitation of the vulnerability may result in system compromise.

Firefox ESR
Mozilla Firefox
SUSE Linux
Opensuse

Update to version 52.2.

Firefox ESR - update to 52.2.0
Mozilla Firefox - update to 54.0

• https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/

• openSUSE update for Mozilla
• SUSE Linux update for MozillaFirefox
• SUSE Linux update for MozillaFirefox
• Multiple vulnerabilities in Firefox ESR
• Multiple vulnerabilities in Mozilla Firefox