Vulnerability in Microsoft Windows
CVE-2017-7766
An attack using manipulation of "updater.ini" contents, used by the Mozilla Windows Updater, and privilege escalation through the Mozilla Maintenance Service to allow for arbitrary file execution and deletion by the Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.
EPSS: 0.004 (30.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Microsoft Windows
- Mozilla Firefox — versions unspecified
- Mozilla Firefox Esr — versions unspecified
References
- security@mozilla.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- security@mozilla.org (x_refsource_CONFIRM, Vendor Advisory)
- security@mozilla.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
- security@mozilla.org (x_refsource_CONFIRM, Issue Tracking, Vendor Advisory)
- security@mozilla.org (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2017-7766?
- CVE-2017-7766 is a high-severity vulnerability in Microsoft Windows. CVSS score: 7.8/10. Published 2018-06-11.
- How severe is CVE-2017-7766?
- High severity. CVSS v3 base score is 7.8 out of 10.