PT-2017-3992 · Mozilla+3 · Firefox Esr+5
Stephen Fewer
·
Publicado
2017-06-14
·
Atualizado
2024-12-12
·
CVE-2017-7804
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 55
Firefox ESR versions prior to 52.3
Thunderbird versions prior to 52.3
Description
The issue is related to the destructor function for the WindowsDllDetourPatcher class, which can be exploited by malicious code to write arbitrary data to a controlled location in memory. This can bypass existing memory protections. The attack is limited to Windows operating systems. The vulnerability is associated with insufficient input validation in the destructor function of the WindowsDllDetourPatcher class in Firefox, Firefox ESR, and Thunderbird browsers, allowing a remote attacker to potentially elevate their privileges.
Recommendations
For Firefox versions prior to 55, update to version 55 or later.
For Firefox ESR versions prior to 52.3, update to version 52.3 or later.
For Thunderbird versions prior to 52.3, update to version 52.3 or later.
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Firefox
Firefox Esr
Suse
Thunderbird
Windows