CVE-2017-7796: Input Validation
First published: Tue Aug 08 2017(Updated: )
On Windows systems, the logger run by the Windows updater deletes the file "update.log" before it runs in order to write a new log of that name. The path to this file is supplied at the command line to the updater and could be used in concert with another local exploit to delete a different file named "update.log" instead of the one intended. Note: This attack only affects Windows operating systems. Other operating systems are not affected.
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Firefox | <55.0 | |
| Microsoft Windows | ||
| Firefox | <55 | 55 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2017-7798
- CVE-2017-7800
- CVE-2017-7801
- CVE-2017-7809
- CVE-2017-7784
- CVE-2017-7802
- CVE-2017-7785
- CVE-2017-7786
- CVE-2017-7806
- CVE-2017-7753
- CVE-2017-7787
- CVE-2017-7807
- CVE-2017-7792
- CVE-2017-7804
- CVE-2017-7791
- CVE-2017-7808
- CVE-2017-7782
- CVE-2017-7781
- CVE-2017-7794
- CVE-2017-7803
- CVE-2017-7799
- CVE-2017-7783
- CVE-2017-7788
- CVE-2017-7789
- CVE-2017-7790
- CVE-2017-7796
- CVE-2017-7797
- CVE-2017-7780
- CVE-2017-7779
Frequently Asked Questions
What is the severity of CVE-2017-7796?
CVE-2017-7796 has a moderate severity level due to its potential for abuse in conjunction with other local exploits.
How can I mitigate CVE-2017-7796?
To mitigate CVE-2017-7796, users should upgrade Firefox to version 55 or later.
What type of systems are affected by CVE-2017-7796?
CVE-2017-7796 affects Windows systems running Mozilla Firefox versions prior to 55.
Is there a specific version of Firefox that is vulnerable to CVE-2017-7796?
Yes, Firefox versions below 55 are vulnerable to CVE-2017-7796.
What is the nature of the exploitation in CVE-2017-7796?
CVE-2017-7796 allows for the deletion of files by manipulating the update log path provided to the Windows updater.
- agent/references
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/severity
- agent/weakness
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/mozilla-advisory
- source/Mozilla
- agent/software-canonical-lookup
- vendor/mozilla
- canonical/firefox
- vendor/microsoft
- canonical/microsoft windows