#VU8622 Improper access control in Mozilla Firefox - CVE-2017-7812

Vulnerability identifier: #VU8622

Vulnerability risk: Medium

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2017-7812

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
Mozilla Firefox

Software vendor:
Mozilla

The vulnerability allows a remote attacker to read local files on user's system.

If web content on a page is dragged onto portions of the browser UI, such as the tab bar, links can be opened that otherwise would not be allowed to open. This can allow malicious web content to open a locally stored file through file: URLs.

Update to version 56.0.

• https://www.mozilla.org/en-US/security/advisories/mfsa2017-21/