CVE-2017-7767

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-06-11 · updated 2026-06-17
Weakness: CWE-269

Description

The Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary files with junk data using the Mozilla Windows Updater, which runs with the Maintenance Service's privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.

Affected products

Mozilla Firefox: before 52.2.0; before 54.0 — fixed in 52.2.0, 54.0

How to fix

Upgrade to a fixed version: Mozilla Firefox 52.2.0, 54.0. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/99057
http://www.securitytracker.com/id/1038689
https://bugzilla.mozilla.org/show_bug.cgi?id=1336964
https://www.mozilla.org/security/advisories/mfsa2017-15/
https://www.mozilla.org/security/advisories/mfsa2017-16/
http://www.securityfocus.com/bid/99057
http://www.securitytracker.com/id/1038689
https://bugzilla.mozilla.org/show_bug.cgi?id=1336964
https://www.mozilla.org/security/advisories/mfsa2017-15/
https://www.mozilla.org/security/advisories/mfsa2017-16/

Get alerted when CVE-2017-7767 or the next vulnerability affects your stack