PT-2017-4009 · Mozilla+2 · Firefox+2
Jann Horn
·
Published
2017-06-19
·
Updated
2024-12-12
·
CVE-2017-7794
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Firefox versions prior to 55
Description
The issue is related to the sandbox broker in Firefox, which allows files to be truncated even when the sandbox only has read access to the local file system and no write permissions. This can be exploited if the content process is compromised, potentially leading to unauthorized access to protected information, disruption of its integrity, or denial of service. This issue specifically affects Linux systems, with other operating systems not being affected.
Recommendations
For versions prior to 55, update to version 55 or later to resolve the issue. As a temporary workaround, consider restricting the sandbox broker's access to sensitive files until a patch is applied.
Exploit
Fix
Incorrect Default Permissions
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Firefox
Ubuntu