CVE-2017-7761

Description

The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users. When this is combined with creation of a junction (a form of symbolic link), protected files in the target directory of the junction can be deleted by the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.

Read the notes from the security team

• How can I get the fixes?
• What do statuses mean?

Notes

Severity score breakdown

CVSS version: CVSS v3.0

References

• MITRE
• NVD
• Launchpad
• Debian

Other references

• https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/
• https://www.cve.org/CVERecord?id=CVE-2017-7761