Vulnerability identifier: #VU7848

Vulnerability risk: Low

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2017-7783

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Mozilla Firefox
Client/Desktop applications / Web browsers

Vendor: Mozilla

Description
The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to improper input validation. A remote attacker can trick the victim into visiting a specially crafted website containing a specially crafted username and password combination, trigger modal prompt and cause the browser to crash.

Successful exploitation of the vulnerability results in denial of service.

Mitigation
Update to version 55.0.

Vulnerable software versions

Mozilla Firefox: 45.0 - 54.0

---

External links
http://www.mozilla.org/en-US/security/advisories/mfsa2017-18/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.