PT-2017-4026 · Mozilla+2 · Firefox+2

Ezra Caltum · Publicado 2017-09-19 · Atualizado 2024-12-12 · CVE-2017-7836

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 57

Description The issue is related to the "pingsender" executable used by the Firefox Health Report, which dynamically loads a system copy of libcurl. An attacker with local system access could replace libcurl, allowing for privilege escalation as the replaced libcurl code will run with Firefox's privileges. This issue affects OS X and Linux systems, while Windows systems are not affected.

Recommendations For versions prior to 57, update to version 57 or later to resolve the issue. As a temporary workaround, consider restricting access to the system copy of libcurl to minimize the risk of exploitation.

Correção

Uncontrolled Search Path Element

Enumeração de Fraquezas

CWE-427

Identificadores relacionados

ALT-PU-2017-2739

BDU:2021-00211

CVE-2017-7836

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

Produtos afetados

Alt Linux

Firefox

Libcurl

Referências · 1872

• https://suse.com/security/cve/CVE-2023-25728 · Nota
• https://suse.com/security/cve/CVE-2022-31743 · Nota
• https://suse.com/security/cve/CVE-2018-12392 · Nota
• https://suse.com/security/cve/CVE-2024-5698 · Nota
• https://suse.com/security/cve/CVE-2013-1701 · Nota
• https://suse.com/security/cve/CVE-2024-5687 · Nota
• https://suse.com/security/cve/CVE-2022-24713 · Nota
• https://suse.com/security/cve/CVE-2014-8642 · Nota
• https://suse.com/security/cve/CVE-2015-4516 · Nota
• https://suse.com/security/cve/CVE-2019-11716 · Nota
• https://suse.com/security/cve/CVE-2023-28176 · Nota
• https://suse.com/security/cve/CVE-2021-38494 · Nota
• https://suse.com/security/cve/CVE-2012-1965 · Nota
• https://suse.com/security/cve/CVE-2013-1687 · Nota
• https://suse.com/security/cve/CVE-2020-6822 · Nota