CVE-2017-5397

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-06-11 · updated 2026-06-17
Weakness: CWE-829

Description

The cache directory on the local file system is set to be world writable. Firefox defaults to extracting libraries from this cache. This allows for the possibility of an installed malicious application or tools with write access to the file system to replace files used by Firefox with their own versions. This vulnerability affects Firefox < 51.0.3.

Affected products

Mozilla Firefox: before 51.0.3 — fixed in 51.0.3

How to fix

Upgrade to a fixed version: Mozilla Firefox 51.0.3. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/96144
https://bugzilla.mozilla.org/show_bug.cgi?id=1337304
https://www.mozilla.org/security/advisories/mfsa2017-04/
http://www.securityfocus.com/bid/96144
https://bugzilla.mozilla.org/show_bug.cgi?id=1337304
https://www.mozilla.org/security/advisories/mfsa2017-04/

Get alerted when CVE-2017-5397 or the next vulnerability affects your stack