CVE-2017-7804: Input Validation
First published: Tue Aug 08 2017(Updated: )
The destructor function for the "WindowsDllDetourPatcher" class can be re-purposed by malicious code in concert with another vulnerability to write arbitrary data to an attacker controlled location in memory. This can be used to bypass existing memory protections in this situation. Note: This attack only affects Windows operating systems. Other operating systems are not affected. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| <55 | 55 | |
| <52.3 | 52.3 | |
| Mozilla Thunderbird | <52.3 | 52.3 |
| <52.3 | 52.3 | |
| Mozilla Firefox | <55.0 | |
| Mozilla Firefox ESR | <52.3.0 | |
| Mozilla Thunderbird | <52.3.0 | |
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/show_bug.cgi?id=1372849
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-20/
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-19/
- http://www.securityfocus.com/bid/100234
- http://www.securitytracker.com/id/1039124
- https://www.mozilla.org/security/advisories/mfsa2017-18/
- https://www.mozilla.org/security/advisories/mfsa2017-19/
- https://www.mozilla.org/security/advisories/mfsa2017-20/
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2017-7800
- CVE-2017-7801
- CVE-2017-7809
- CVE-2017-7784
- CVE-2017-7802
- CVE-2017-7785
- CVE-2017-7786
- CVE-2017-7753
- CVE-2017-7787
- CVE-2017-7807
- CVE-2017-7792
- CVE-2017-7804
- CVE-2017-7791
- CVE-2017-7782
- CVE-2017-7803
- CVE-2017-7779
- CVE-2017-7798
- CVE-2017-7806
- CVE-2017-7808
- CVE-2017-7781
- CVE-2017-7794
- CVE-2017-7799
- CVE-2017-7783
- CVE-2017-7788
- CVE-2017-7789
- CVE-2017-7790
- CVE-2017-7796
- CVE-2017-7797
- CVE-2017-7780
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- agent/softwarecombine
- collector/mozilla-advisory
- source/Mozilla
- agent/software-canonical-lookup
- agent/weakness
- agent/author
- agent/severity
- agent/references
- agent/event
- agent/software-canonical-lookup-request
- agent/tags
- agent/description
- collector/nvd-index
- collector/mitre-cve
- source/MITRE
- vendor/mozilla
- canonical/mozilla thunderbird
- canonical/mozilla firefox esr
- canonical/mozilla firefox
- vendor/microsoft
- canonical/microsoft windows