PT-2017-4004 · Mozilla+3 · Firefox Esr+5

Arthur Edelstein · Published 2017-03-02 · Updated 2024-12-12 · CVE-2017-7782

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 55 Firefox ESR versions prior to 52.3 Thunderbird versions prior to 52.3

Description The issue is related to an error in the "WindowsDllDetourPatcher" where a Read/Write/Execute block is allocated but not protected, violating DEP protections. This affects Windows operating systems. The vulnerability is associated with insecure privilege management in the implementation of the WindowsDllDetourPatcher class in Firefox, Firefox ESR, and Thunderbird browsers, potentially allowing a remote attacker to compromise data integrity.

Recommendations For Firefox versions prior to 55, update to version 55 or later. For Firefox ESR versions prior to 52.3, update to version 52.3 or later. For Thunderbird versions prior to 52.3, update to version 52.3 or later.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

ALT-PU-2017-2019

ALT-PU-2017-2060

BDU:2021-00040

CVE-2017-7782

MGASA-2018-0018

OPENSUSE-SU-2017:2209-1

OPENSUSE-SU-2017_2151-1

OPENSUSE-SU-2017_2209-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:10601-1

OPENSUSE-SU-2024:14572-1

SUSE-SU-2017:2302-1

SUSE-SU-2017:2589-1

Affected Products

Alt Linux

Firefox

Firefox Esr

Suse

Thunderbird

Windows

References · 1984

• https://advisories.mageia.org/MGASA-2018-0018.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2017:2302-1 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2017-19 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2017-20 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2017-19 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2017-18 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7782 · Security Note
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=1212483 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00040 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2017-12 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-7782 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se15-bulletin-20201201SE15 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2017-05 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10601-1 · Vendor Advisory