PT-2018-3796 · Yandex · Yandex Browser

Published 2018-01-19 · Updated 2018-02-01 · CVE-2017-7327

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Yandex Browser versions prior to 17.4.1

Description The issue exists due to the lack of checks for loading paths of certain DLL files, including dnsapi.dll, winmm.dll, ntmarta.dll, cryptbase.dll, and profapi.dll. This can allow an attacker to execute arbitrary code.

Recommendations For versions prior to 17.4.1, update to version 17.4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable DLL files until a patch is available.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

BDU:2022-03581

CVE-2017-7327

Affected Products

Yandex Browser

References · 5

• https://bdu.fstec.ru/vul/2022-03581 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-7327 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7327 · Vendor Advisory
• https://browser.yandex.com/security/changelogs/fixed-in-version-17-4 · Vendor Advisory
• https://yandex.com/bugbounty/i/hall-of-fame-browser · Note