PT-2017-4020 · Mozilla+2 · Firefox+2

Abdulrahman Alqabandi · Published 2017-03-11 · Updated 2024-12-12 · CVE-2017-7821

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 56

Description The issue is related to insufficient permission checks for a critical resource in the WebExtensions module of Mozilla Firefox. This could allow a remote attacker to elevate their privileges. Additionally, WebExtensions can download and attempt to open certain non-executable file types without specific user interaction, potentially triggering known vulnerabilities in programs that handle those document types.

Recommendations For versions prior to 56, update to a version that contains a fix for this issue to prevent potential exploitation. As a temporary workaround, consider restricting the use of WebExtensions to minimize the risk of exploitation. Avoid using WebExtensions to download and open files of non-executable types until the issue is resolved.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

ALT-PU-2017-2437

ALT-PU-2018-1854

BDU:2021-00179

CVE-2017-7821

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

USN-3435-1

USN-3435-2

Affected Products

Alt Linux

Firefox

Ubuntu

References · 1896

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1346515 · Exploit
• https://mozilla.org/en-US/security/advisories/mfsa2017-21 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7814 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7818 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2017-21 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7793 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7821 · Security Note
• https://ubuntu.com/security/CVE-2017-7822 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7815 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-7821 · Security Note
• https://wiki.astralinux.ru/astra-linux-se15-bulletin-20201201SE15 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7816 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7820 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3435-2 · Vendor Advisory