Improper input validation in Microsoft Windows
CVE-2017-7804
The destructor function for the "WindowsDllDetourPatcher" class can be re-purposed by malicious code in concert with another vulnerability to write arbitrary data to an attacker controlled location in memory. This can be used to bypass existing memory protections in this situation. Note: This attack only affects Windows operating systems. Other operating systems are not affected. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.
EPSS exploit prediction
EPSS: 0.015 (73.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 73rd percentile — 73.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.015 · change: 0.000
Affected products
- Microsoft Windows
- Mozilla Firefox — versions unspecified
- Mozilla Firefox Esr — versions unspecified
- Mozilla Thunderbird — versions unspecified
Weakness classification (CWE)
References
- www.mozilla.org/security/advisories/mfsa2017-19/ (Vendor Advisory)
- www.mozilla.org/security/advisories/mfsa2017-20/ (Vendor Advisory)
- www.mozilla.org/security/advisories/mfsa2017-18/ (Vendor Advisory)
- www.securityfocus.com/bid/100234 (VDB Entry, Third Party Advisory, vdb-entry)
- www.securitytracker.com/id/1039124 (VDB Entry, Third Party Advisory, vdb-entry)
- bugzilla.mozilla.org/show_bug.cgi (Third Party Advisory, Issue Tracking)
Frequently asked questions
- What is CVE-2017-7804?
- CVE-2017-7804 is a high-severity vulnerability in Microsoft Windows, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2018-06-11.
- How severe is CVE-2017-7804?
- High severity. CVSS v3 base score is 7.5 out of 10.