{"id":"CVE-2017-5409","aliases":["EUVD-2017-14513","GHSA-3pwm-r9r6-wpwp","MGASA-2018-0018","SUSE-SU-2017:0714-1","SUSE-SU-2017:0732-1"],"status":"published","title":"The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local...","description":"The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter through the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR \u003c 45.8 and Firefox \u003c 52.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00355,"percentile":0.29401,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2017-03-17T07:38:03Z","modified":"2026-06-17T01:20:25Z","affected":[{"source":"osv","ecosystem":"Mageia:5","package":"iceape","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.49.1-3.mga5"}]}],"bundled":112},{"source":"osv","ecosystem":"Mageia:6","package":"iceape","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.49.1-3.mga6"}]}],"bundled":112},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.8.0esr-102.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.8.0esr-102.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.8.0esr-102.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.8.0esr-102.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.8.0esr-102.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.8.0esr-102.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.8.0esr-102.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.8.0esr-102.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.8.0esr-102.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.8.0esr-102.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.8.0esr-102.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.8.0esr-68.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.8.0esr-68.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Manager 2.1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.8.0esr-68.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Manager Proxy 2.1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.8.0esr-68.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.8.0esr-68.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.8.0esr-68.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.8.0esr-68.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.8.0esr-68.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"45.8.0esr-68.1"}]}],"bundled":10}],"products":[{"vendor":"mozilla","product":"firefox"},{"vendor":"mozilla","product":"firefox esr"}],"references":[{"url":"http://www.securityfocus.com/bid/96696","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2017-05/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.securitytracker.com/id/1037966","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2017-06/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1321814","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-5409"},{"url":"https://www.mozilla.org/security/advisories/mfsa2017-05"},{"url":"https://www.mozilla.org/security/advisories/mfsa2017-06"},{"url":"https://github.com/advisories/GHSA-3pwm-r9r6-wpwp"},{"url":"https://advisories.mageia.org/MGASA-2018-0018.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22283","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2017-05/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2017-12/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2017-19/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2017-22/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2017-25/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2017-28/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170714-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1028391","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5400","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5401","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5402","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5404","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5407","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5408","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5410","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170732-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1027527","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-5409","description":"The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter through the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR \u003c 45.8 and Firefox \u003c 52.","status":"published","published":"2018-06-11T21:00:00Z","modified":"2024-08-05T14:55:35.846Z","updated_at":"2026-11-02T14:33:12.599234Z"}],"euvd":[{"id":"EUVD-2017-14513","description":"The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter through the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR \u003c 45.8 and Firefox \u003c 52.","status":"published","published":"2018-06-11T21:00:00Z","modified":"2024-08-05T14:55:35Z","updated_at":"2026-11-03T02:39:15.955222Z"}],"ghsa":[{"id":"GHSA-3pwm-r9r6-wpwp","title":"The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local...","description":"The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter through the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR \u003c 45.8 and Firefox \u003c 52.","status":"published","published":"2022-05-13T01:46:10Z","modified":"2025-11-25T18:32:08Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:04:56.426173Z"}],"nvd":[{"id":"CVE-2017-5409","description":"The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter through the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR \u003c 45.8 and Firefox \u003c 52.","status":"published","published":"2018-06-11T21:29:04.483Z","modified":"2026-06-17T01:20:25.707Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.6,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:04:17.638656Z"}],"osv":[{"id":"MGASA-2018-0018","title":"Updated iceape packages fix security vulnerabilities","description":"Updated iceape packages include security fixes from upstream Seamonkey\nand Firefox:\n\nMultiple flaws were found in the way Iceape 2.48 processes various types\nof web content, where loading a web page containing malicious content\ncould cause Iceape to crash, execute arbitrary code, or disclose\nsensitive information. (CVE-2016-10196,CVE-2017-5398,CVE-2017-5399,\nCVE-2017-5400,CVE-2017-5401,CVE-2017-5402,CVE-2017-5403,CVE-2017-5404,\nCVE-2017-5405,CVE-2017-5406,CVE-2017-5407,CVE-2017-5409,CVE-2017-5410,\nCVE-2017-5411,CVE-2017-5408,CVE-2017-5412,CVE-2017-5413,CVE-2017-5414,\nCVE-2017-5415,CVE-2017-5416,CVE-2017-5417,CVE-2017-5425,CVE-2017-5426,\nCVE-2017-5427,CVE-2017-5418,CVE-2017-5419,CVE-2017-5420,CVE-2017-5421,\nCVE-2017-5422,CVE-2017-5429,CVE-2017-5430,CVE-2017-5432,CVE-2017-5433,\nCVE-2017-5434,CVE-2017-5435,CVE-2017-5436,CVE-2017-5438,CVE-2017-5439,\nCVE-2017-5440,CVE-2017-5441,CVE-2017-5442,CVE-2017-5443,CVE-2017-5444,\nCVE-2017-5445,CVE-2017-5446,CVE-2017-5447,CVE-2017-5448,CVE-2017-5449,\nCVE-2017-5451,CVE-2017-5454,CVE-2017-5455,CVE-2017-5456,CVE-2017-5459,\nCVE-2017-5460,CVE-2017-5461,CVE-2017-5462,CVE-2017-5464,CVE-2017-5465,\nCVE-2017-5466,CVE-2017-5467,CVE-2017-5469,CVE-2017-5470,CVE-2017-5472,\nCVE-2017-7749,CVE-2017-7750,CVE-2017-7751,CVE-2017-7752,CVE-2017-7753,\nCVE-2017-7754,CVE-2017-7755,CVE-2017-7756,CVE-2017-7757,CVE-2017-7758,\nCVE-2017-7760,CVE-2017-7761,CVE-2017-7763,CVE-2017-7764,CVE-2017-7765,\nCVE-2017-7766,CVE-2017-7767,CVE-2017-7768,CVE-2017-7778,CVE-2017-7779,\nCVE-2017-7782,CVE-2017-7784,CVE-2017-7785,CVE-2017-7786,CVE-2017-7787,\nCVE-2017-7791,CVE-2017-7792,CVE-2017-7793,CVE-2017-7798,CVE-2017-7800,\nCVE-2017-7801,CVE-2017-7802,CVE-2017-7803,CVE-2017-7804,CVE-2017-7805,\nCVE-2017-7807,CVE-2017-7809,CVE-2017-7810,CVE-2017-7814,CVE-2017-7818,\nCVE-2017-7819,CVE-2017-7823,CVE-2017-7824,CVE-2017-7825,CVE-2017-7826,\nCVE-2017-7828,CVE-2017-7830,CVE-2017-7843,CVE-2017-7845)\n","status":"published","published":"2018-01-02T11:48:29Z","modified":"2026-04-16T06:24:36.415771916Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"SUSE-SU-2017:0714-1","title":"Security update for MozillaFirefox","description":"\nThis update for MozillaFirefox to ESR 45.8 fixes the following issues:\n\nSecurity issues fixed (bsc#1028391):\n- CVE-2017-5402: Use-after-free working with events in FontFace objects\n- CVE-2017-5410: Memory corruption during JavaScript garbage collection incremental sweeping\n- CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP\n- CVE-2017-5401: Memory Corruption when handling ErrorResult\n- CVE-2017-5407: Pixel and history stealing via floating-point timing side channel with SVG filters\n- CVE-2017-5404: Use-after-free working with ranges in selections\n- CVE-2017-5405: FTP response codes can cause use of uninitialized values for ports\n- CVE-2017-5408: Cross-origin reading of video captions in violation of CORS\n- CVE-2017-5409: File deletion via callback parameter in Mozilla Windows Updater and Maintenance Service\n- CVE-2017-5398: Memory safety bugs fixed in Firefox 52 and Firefox ESR 45.8\n","status":"published","published":"2017-03-17T07:38:03Z","modified":"2026-02-04T03:19:58.429739Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:0732-1","title":"Security update for MozillaFirefox","description":"\nThis update for MozillaFirefox to ESR 45.8 fixes the following issues:\n\nSecurity issues fixed (bsc#1028391):\n- CVE-2017-5402: Use-after-free working with events in FontFace objects\n- CVE-2017-5410: Memory corruption during JavaScript garbage collection incremental sweeping\n- CVE-2017-5400: asm.js JIT-spray bypass of ASLR and DEP\n- CVE-2017-5401: Memory Corruption when handling ErrorResult\n- CVE-2017-5407: Pixel and history stealing via floating-point timing side channel with SVG filters\n- CVE-2017-5404: Use-after-free working with ranges in selections\n- CVE-2017-5405: FTP response codes can cause use of uninitialized values for ports\n- CVE-2017-5408: Cross-origin reading of video captions in violation of CORS\n- CVE-2017-5409: File deletion via callback parameter in Mozilla Windows Updater and Maintenance Service\n- CVE-2017-5398: Memory safety bugs fixed in Firefox 52 and Firefox ESR 45.8\n\nBugfixes:\n- fix crashes on Itanium (bsc#1027527)\n","status":"published","published":"2017-03-17T14:19:04Z","modified":"2026-02-04T02:18:55.833749Z","updated_at":"2026-11-02T15:53:43.83457Z"}]}}