Insecure DLL library loading in Firefox ESR - CVE-2017-7761

Vulnerability identifier: #VU7074

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2017-7761

CWE-ID: CWE-427

Exploitation vector: Local access

Exploit availability: No public exploit available

Vendor: Mozilla

Affected software:
Firefox ESR

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists in the Mozilla Maintenance Service helper.exe application due to insecure .dll loading mechanism when opening files. A local attacker can place a specially crafted .dll file along with junction protected files on a remote SBM or WebDAV share, trick the victim into opening legitimate media file and execute arbitrary code on the target system with system privileges.

Successful exploitation of the vulnerability may result in system compromise.

Update to version 52.2.

• https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/