CVE-2017-5409: Medium severity firefox vulnerability
The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter through the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2017-5400
- CVE-2017-5401
- CVE-2017-5402
- CVE-2017-5403
- CVE-2017-5404
- CVE-2017-5406
- CVE-2017-5407
- CVE-2017-5410
- CVE-2017-5411
- CVE-2017-5409
- CVE-2017-5408
- CVE-2017-5412
- CVE-2017-5413
- CVE-2017-5414
- CVE-2017-5415
- CVE-2017-5416
- CVE-2017-5417
- CVE-2017-5425
- CVE-2017-5426
- CVE-2017-5427
- CVE-2017-5418
- CVE-2017-5419
- CVE-2017-5420
- CVE-2017-5405
- CVE-2017-5421
- CVE-2017-5422
- CVE-2017-5399
- CVE-2017-5398
Frequently Asked Questions
What is the severity of CVE-2017-5409?
CVE-2017-5409 has been classified as a high severity vulnerability due to its potential for local file deletion by non-privileged users.
How do I fix CVE-2017-5409?
To mitigate CVE-2017-5409, users should update affected Mozilla Firefox products to versions 45.8 or higher for Firefox ESR and 52 or higher for regular Firefox.
Who is affected by CVE-2017-5409?
CVE-2017-5409 affects users of Mozilla Firefox and Firefox ESR prior to versions 45.8 and 52 respectively, on Windows operating systems.
Can CVE-2017-5409 be exploited remotely?
CVE-2017-5409 cannot be exploited remotely as it requires local system access to successfully execute the attack.
What specific products are impacted by CVE-2017-5409?
The impacted products include Mozilla Firefox up to version 52 and Mozilla Firefox ESR up to version 45.8.