VULNERABILITY INTELLIGENCE
CVE-2017-7766
CVSS score7.8 HIGH
EPSS probability0.38%
CISA KEVNot currently listed
Published2018-06-11
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
An attack using manipulation of "updater.ini" contents, used by the Mozilla Windows Updater, and privilege escalation through the Mozilla Maintenance Service to allow for arbitrary file execution and deletion by the Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.
Primary references
- security@mozilla.org — Third Party Advisory, VDB Entry
- security@mozilla.org — Third Party Advisory, VDB Entry
- security@mozilla.org — Issue Tracking, Vendor Advisory
- security@mozilla.org — Vendor Advisory
- security@mozilla.org — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
- af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
- af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory