Vulnerability Details : CVE-2017-7755
The Firefox installer on Windows can be made to load malicious DLL files stored in the same directory as the installer when it is run. This allows privileged execution if the installer is run with elevated privileges. Note: This attack only affects Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
Vulnerability category: File inclusion
Products affected by CVE-2017-7755
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-7755
0.43%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 61 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-7755
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
|
7.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2017-7755
-
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-7755
-
https://www.mozilla.org/security/advisories/mfsa2017-17/
Security vulnerabilities fixed in Thunderbird 52.2 — MozillaVendor Advisory
-
http://www.securityfocus.com/bid/99057
Mozilla Firefox Multiple Security VulnerabilitiesThird Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1038689
Mozilla Firefox Multiple Bugs Let Remote Users Spoof URLs, Obtain Potentially Sensitive Information, and Execute Arbitrary Code and Let Local Users Gain Elevated Privileges - SecurityTrackerThird Party Advisory;VDB Entry
-
https://www.mozilla.org/security/advisories/mfsa2017-15/
Security vulnerabilities fixed in Firefox 54 — MozillaVendor Advisory
-
https://www.mozilla.org/security/advisories/mfsa2017-16/
Security vulnerabilities fixed in Firefox ESR 52.2 — MozillaVendor Advisory
-
https://bugzilla.mozilla.org/show_bug.cgi?id=1361326
1361326 - (CVE-2017-7755) DLL Hijacking Firefox installerIssue Tracking;Vendor Advisory
Jump to