Privilege escalation in Firefox ESR - CVE-2017-7766

Vulnerability identifier: #VU7077

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-7766

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists in the Mozilla Windows Updater due to improper input validation. A local attacker can use manipulation of updater.ini contents and the Maintenance Service to execute and delete arbitrary files with system privileges.

Successful exploitation of the vulnerability may result in system compromise.

Firefox ESR
Mozilla Firefox
Opensuse

Update to version 52.2.

Firefox ESR - update to 52.2.0
Mozilla Firefox - update to 54.0

• https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/

• openSUSE update for Mozilla
• Multiple vulnerabilities in Firefox ESR
• Multiple vulnerabilities in Mozilla Firefox