Privilege escalation in Firefox ESR - CVE-2017-7766

Vulnerability identifier: #VU7077

CSH Severity: Low

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2017-7766

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

Vendor: Mozilla

Affected software:
Firefox ESR

The vulnerability allows a local attacker to gain elevated privileges on the target system.

The vulnerability exists in the Mozilla Windows Updater due to improper input validation. A local attacker can use manipulation of updater.ini contents and the Maintenance Service to execute and delete arbitrary files with system privileges.

Successful exploitation of the vulnerability may result in system compromise.

Update to version 52.2.

• https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/