{"id":"CVE-2017-7761","aliases":["EUVD-2017-16736","GHSA-mcm9-29wj-77v9","MGASA-2018-0018","SUSE-SU-2017:1669-1","SUSE-SU-2017:2235-1"],"status":"published","title":"The Mozilla Maintenance Service \"helper.exe\" application creates a temporary directory writable...","description":"The Mozilla Maintenance Service \"helper.exe\" application creates a temporary directory writable by non-privileged users. When this is combined with creation of a junction (a form of symbolic link), protected files in the target directory of the junction can be deleted by the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR \u003c 52.2 and Firefox \u003c 54.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00305,"percentile":0.23437,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-276"],"published":"2017-06-26T06:11:53Z","modified":"2026-06-17T01:25:08Z","affected":[{"source":"osv","ecosystem":"Mageia:5","package":"iceape","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.49.1-3.mga5"}]}],"bundled":112},{"source":"osv","ecosystem":"Mageia:6","package":"iceape","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.49.1-3.mga6"}]}],"bundled":112},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.2.0esr-108.3"}]}],"bundled":50},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52-31.1"}]}],"bundled":50},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.2.0esr-108.3"}]}],"bundled":50},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52-31.1"}]}],"bundled":50},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.2.0esr-108.3"}]}],"bundled":50},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52-31.1"}]}],"bundled":50},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.2.0esr-108.3"}]}],"bundled":50},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52-31.1"}]}],"bundled":50},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.2.0esr-108.3"}]}],"bundled":50},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52-31.1"}]}],"bundled":50},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.2.0esr-108.3"}]}],"bundled":50},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.2.0esr-108.3"}]}],"bundled":50},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52-31.1"}]}],"bundled":50},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.2.0esr-108.3"}]}],"bundled":50},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52-31.1"}]}],"bundled":50},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.2.0esr-108.3"}]}],"bundled":50},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52-31.1"}]}],"bundled":50},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.2.0esr-108.3"}]}],"bundled":50},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"MozillaFirefox-branding-SLE","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52-31.1"}]}],"bundled":50},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.2.0esr-72.5.2"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29.5-47.3.2"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.2.0esr-72.5.2"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"MozillaFirefox-branding-SLED","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52-24.3.44"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"firefox-gcc5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1+r233831-7.1"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"firefox-libffi-gcc5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1+r233831-7.1"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29.5-47.3.2"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.2.0esr-72.5.2"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"MozillaFirefox-branding-SLED","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52-24.3.44"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"firefox-gcc5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1+r233831-7.1"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"firefox-libffi-gcc5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1+r233831-7.1"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-LTSS","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29.5-47.3.2"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.2.0esr-72.5.2"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"MozillaFirefox-branding-SLED","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52-24.3.44"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"firefox-gcc5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1+r233831-7.1"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"firefox-libffi-gcc5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1+r233831-7.1"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP3-TERADATA","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29.5-47.3.2"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.2.0esr-72.5.2"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"MozillaFirefox-branding-SLED","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52-24.3.44"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"firefox-gcc5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1+r233831-7.1"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"firefox-libffi-gcc5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1+r233831-7.1"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29.5-47.3.2"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52.2.0esr-72.5.2"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"MozillaFirefox-branding-SLED","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"52-24.3.44"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"firefox-gcc5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1+r233831-7.1"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"firefox-libffi-gcc5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.3.1+r233831-7.1"}]}],"bundled":51},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"mozilla-nss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.29.5-47.3.2"}]}],"bundled":51}],"products":[{"vendor":"mozilla","product":"firefox"},{"vendor":"mozilla","product":"firefox esr"}],"references":[{"url":"http://www.securityfocus.com/bid/99057","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1215648","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2017-15/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.securitytracker.com/id/1038689","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://sourceforge.net/p/nsis/bugs/1125/","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2017-16/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7761"},{"url":"https://sourceforge.net/p/nsis/bugs/1125"},{"url":"https://www.mozilla.org/security/advisories/mfsa2017-15"},{"url":"https://www.mozilla.org/security/advisories/mfsa2017-16"},{"url":"https://github.com/advisories/GHSA-mcm9-29wj-77v9"},{"url":"https://advisories.mageia.org/MGASA-2018-0018.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22283","tags":["report"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2017-05/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2017-12/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2017-19/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2017-22/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2017-25/","tags":["advisory"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2017-28/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171669-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1035082","tags":["report"]},{"url":"https://bugzilla.suse.com/1043960","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-10196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5429","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5430","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5432","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5433","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5438","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5439","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5440","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5442","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5443","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5445","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5448","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5449","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5451","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5454","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5455","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5461","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5462","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5464","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5466","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5467","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5469","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-5472","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7749","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7755","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7756","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7757","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7758","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7761","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7763","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7764","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7765","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7768","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7778","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172235-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1025108","tags":["report"]},{"url":"https://bugzilla.suse.com/1031485","tags":["report"]},{"url":"https://bugzilla.suse.com/930392","tags":["report"]},{"url":"https://bugzilla.suse.com/930496","tags":["report"]},{"url":"https://bugzilla.suse.com/935510","tags":["report"]},{"url":"https://bugzilla.suse.com/939460","tags":["report"]},{"url":"https://bugzilla.suse.com/945842","tags":["report"]},{"url":"https://bugzilla.suse.com/953831","tags":["report"]},{"url":"https://bugzilla.suse.com/954002","tags":["report"]},{"url":"https://bugzilla.suse.com/955382","tags":["report"]},{"url":"https://bugzilla.suse.com/962765","tags":["report"]},{"url":"https://bugzilla.suse.com/964468","tags":["report"]},{"url":"https://bugzilla.suse.com/966220","tags":["report"]},{"url":"https://bugzilla.suse.com/968771","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5276","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-7761","description":"The Mozilla Maintenance Service \"helper.exe\" application creates a temporary directory writable by non-privileged users. When this is combined with creation of a junction (a form of symbolic link), protected files in the target directory of the junction can be deleted by the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR \u003c 52.2 and Firefox \u003c 54.","status":"published","published":"2018-06-11T21:00:00Z","modified":"2024-08-05T16:12:28.276Z","updated_at":"2026-11-02T14:33:20.488433Z"}],"euvd":[{"id":"EUVD-2017-16736","description":"The Mozilla Maintenance Service \"helper.exe\" application creates a temporary directory writable by non-privileged users. When this is combined with creation of a junction (a form of symbolic link), protected files in the target directory of the junction can be deleted by the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR \u003c 52.2 and Firefox \u003c 54.","status":"published","published":"2018-06-11T21:00:00Z","modified":"2024-08-05T16:12:28Z","updated_at":"2026-11-03T02:39:07.559484Z"}],"ghsa":[{"id":"GHSA-mcm9-29wj-77v9","title":"The Mozilla Maintenance Service \"helper.exe\" application creates a temporary directory writable...","description":"The Mozilla Maintenance Service \"helper.exe\" application creates a temporary directory writable by non-privileged users. When this is combined with creation of a junction (a form of symbolic link), protected files in the target directory of the junction can be deleted by the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR \u003c 52.2 and Firefox \u003c 54.","status":"published","published":"2022-05-13T01:47:08Z","modified":"2025-11-25T18:33:18Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T15:04:56.973775Z"}],"nvd":[{"id":"CVE-2017-7761","description":"The Mozilla Maintenance Service \"helper.exe\" application creates a temporary directory writable by non-privileged users. When this is combined with creation of a junction (a form of symbolic link), protected files in the target directory of the junction can be deleted by the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR \u003c 52.2 and Firefox \u003c 54.","status":"published","published":"2018-06-11T21:29:08.297Z","modified":"2026-06-17T01:25:08.653Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.6,"vector":"AV:L/AC:L/Au:N/C:N/I:P/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-276"],"updated_at":"2026-11-02T14:04:18.679411Z"}],"osv":[{"id":"MGASA-2018-0018","title":"Updated iceape packages fix security vulnerabilities","description":"Updated iceape packages include security fixes from upstream Seamonkey\nand Firefox:\n\nMultiple flaws were found in the way Iceape 2.48 processes various types\nof web content, where loading a web page containing malicious content\ncould cause Iceape to crash, execute arbitrary code, or disclose\nsensitive information. (CVE-2016-10196,CVE-2017-5398,CVE-2017-5399,\nCVE-2017-5400,CVE-2017-5401,CVE-2017-5402,CVE-2017-5403,CVE-2017-5404,\nCVE-2017-5405,CVE-2017-5406,CVE-2017-5407,CVE-2017-5409,CVE-2017-5410,\nCVE-2017-5411,CVE-2017-5408,CVE-2017-5412,CVE-2017-5413,CVE-2017-5414,\nCVE-2017-5415,CVE-2017-5416,CVE-2017-5417,CVE-2017-5425,CVE-2017-5426,\nCVE-2017-5427,CVE-2017-5418,CVE-2017-5419,CVE-2017-5420,CVE-2017-5421,\nCVE-2017-5422,CVE-2017-5429,CVE-2017-5430,CVE-2017-5432,CVE-2017-5433,\nCVE-2017-5434,CVE-2017-5435,CVE-2017-5436,CVE-2017-5438,CVE-2017-5439,\nCVE-2017-5440,CVE-2017-5441,CVE-2017-5442,CVE-2017-5443,CVE-2017-5444,\nCVE-2017-5445,CVE-2017-5446,CVE-2017-5447,CVE-2017-5448,CVE-2017-5449,\nCVE-2017-5451,CVE-2017-5454,CVE-2017-5455,CVE-2017-5456,CVE-2017-5459,\nCVE-2017-5460,CVE-2017-5461,CVE-2017-5462,CVE-2017-5464,CVE-2017-5465,\nCVE-2017-5466,CVE-2017-5467,CVE-2017-5469,CVE-2017-5470,CVE-2017-5472,\nCVE-2017-7749,CVE-2017-7750,CVE-2017-7751,CVE-2017-7752,CVE-2017-7753,\nCVE-2017-7754,CVE-2017-7755,CVE-2017-7756,CVE-2017-7757,CVE-2017-7758,\nCVE-2017-7760,CVE-2017-7761,CVE-2017-7763,CVE-2017-7764,CVE-2017-7765,\nCVE-2017-7766,CVE-2017-7767,CVE-2017-7768,CVE-2017-7778,CVE-2017-7779,\nCVE-2017-7782,CVE-2017-7784,CVE-2017-7785,CVE-2017-7786,CVE-2017-7787,\nCVE-2017-7791,CVE-2017-7792,CVE-2017-7793,CVE-2017-7798,CVE-2017-7800,\nCVE-2017-7801,CVE-2017-7802,CVE-2017-7803,CVE-2017-7804,CVE-2017-7805,\nCVE-2017-7807,CVE-2017-7809,CVE-2017-7810,CVE-2017-7814,CVE-2017-7818,\nCVE-2017-7819,CVE-2017-7823,CVE-2017-7824,CVE-2017-7825,CVE-2017-7826,\nCVE-2017-7828,CVE-2017-7830,CVE-2017-7843,CVE-2017-7845)\n","status":"published","published":"2018-01-02T11:48:29Z","modified":"2026-04-16T06:24:36.415771916Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"SUSE-SU-2017:1669-1","title":"Security update for MozillaFirefox, MozillaFirefox-branding-SLE","description":"The MozillaFirefox was updated to the new ESR 52.2 release, which fixes the following issues (bsc#1043960):\n\n* MFSA 2017-16/CVE-2017-7758\n  Out-of-bounds read in Opus encoder\n* MFSA 2017-16/CVE-2017-7749\n  Use-after-free during docshell reloading\n* MFSA 2017-16/CVE-2017-7751\n  Use-after-free with content viewer listeners\n* MFSA 2017-16/CVE-2017-5472\n  Use-after-free using destroyed node when regenerating trees\n* MFSA 2017-16/CVE-2017-5470\n  Memory safety bugs fixed in Firefox 54 and Firefox ESR 52.2\n* MFSA 2017-16/CVE-2017-7752\n  Use-after-free with IME input\n* MFSA 2017-16/CVE-2017-7750\n  Use-after-free with track elements\n* MFSA 2017-16/CVE-2017-7768\n  32 byte arbitrary file read through Mozilla Maintenance\n  Service\n* MFSA 2017-16/CVE-2017-7778\n  Vulnerabilities in the Graphite 2 library\n* MFSA 2017-16/CVE-2017-7754\n  Out-of-bounds read in WebGL with ImageInfo object\n* MFSA 2017-16/CVE-2017-7755\n  Privilege escalation through Firefox Installer with same\n  directory DLL files\n* MFSA 2017-16/CVE-2017-7756\n  Use-after-free and use-after-scope logging XHR header errors\n* MFSA 2017-16/CVE-2017-7757\n  Use-after-free in IndexedDB\n* MFSA 2017-16/CVE-2017-7761\n  File deletion and privilege escalation through Mozilla\n  Maintenance Service helper.exe application\n* MFSA 2017-16/CVE-2017-7763\n  Mac fonts render some unicode characters as spaces\n* MFSA 2017-16/CVE-2017-7765\n  Mark of the Web bypass when saving executable files\n* MFSA 2017-16/CVE-2017-7764\n  (bmo#1364283, bmo#http://www.unicode.org/reports/tr31/tr31-26\n   .html#Aspirational_Use_Scripts)\n  Domain spoofing with combination of Canadian Syllabics and\n  other unicode blocks\n\n- update to Firefox ESR 52.1 (bsc#1035082)\n* MFSA 2017-12/CVE-2016-10196\n  Vulnerabilities in Libevent library\n* MFSA 2017-12/CVE-2017-5443\n  Out-of-bounds write during BinHex decoding\n* MFSA 2017-12/CVE-2017-5429\n  Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and\n  Firefox ESR 52.1\n* MFSA 2017-12/CVE-2017-5464\n  Memory corruption with accessibility and DOM manipulation\n* MFSA 2017-12/CVE-2017-5465\n  Out-of-bounds read in ConvolvePixel\n* MFSA 2017-12/CVE-2017-5466\n  Origin confusion when reloading isolated data:text/html URL\n* MFSA 2017-12/CVE-2017-5467\n  Memory corruption when drawing Skia content\n* MFSA 2017-12/CVE-2017-5460\n  Use-after-free in frame selection\n* MFSA 2017-12/CVE-2017-5461\n  Out-of-bounds write in Base64 encoding in NSS\n* MFSA 2017-12/CVE-2017-5448\n  Out-of-bounds write in ClearKeyDecryptor\n* MFSA 2017-12/CVE-2017-5449\n  Crash during bidirectional unicode manipulation with\n  animation\n* MFSA 2017-12/CVE-2017-5446\n  Out-of-bounds read when HTTP/2 DATA frames are sent with\n  incorrect data\n* MFSA 2017-12/CVE-2017-5447\n  Out-of-bounds read during glyph processing\n* MFSA 2017-12/CVE-2017-5444\n  Buffer overflow while parsing application/http-index-format\n  content\n* MFSA 2017-12/CVE-2017-5445\n  Uninitialized values used while parsing application/http-\n  index-format content\n* MFSA 2017-12/CVE-2017-5442\n  Use-after-free during style changes\n* MFSA 2017-12/CVE-2017-5469\n  Potential Buffer overflow in flex-generated code\n* MFSA 2017-12/CVE-2017-5440\n  Use-after-free in txExecutionState destructor during XSLT\n  processing\n* MFSA 2017-12/CVE-2017-5441\n  Use-after-free with selection during scroll events\n* MFSA 2017-12/CVE-2017-5439\n  Use-after-free in nsTArray Length() during XSLT processing\n* MFSA 2017-12/CVE-2017-5438\n  Use-after-free in nsAutoPtr during XSLT processing\n* MFSA 2017-12/CVE-2017-5436\n  Out-of-bounds write with malicious font in Graphite 2\n* MFSA 2017-12/CVE-2017-5435\n  Use-after-free during transaction processing in the editor\n* MFSA 2017-12/CVE-2017-5434\n  Use-after-free during focus handling\n* MFSA 2017-12/CVE-2017-5433\n  Use-after-free in SMIL animation functions\n* MFSA 2017-12/CVE-2017-5432\n  Use-after-free in text input selection\n* MFSA 2017-12/CVE-2017-5430\n  Memory safety bugs fixed in Firefox 53 and Firefox ESR 52.1\n* MFSA 2017-12/CVE-2017-5459\n  Buffer overflow in WebGL\n* MFSA 2017-12/CVE-2017-5462\n  DRBG flaw in NSS\n* MFSA 2017-12/CVE-2017-5455\n  Sandbox escape through internal feed reader APIs\n* MFSA 2017-12/CVE-2017-5454\n  Sandbox escape allowing file system read access through file\n  picker\n* MFSA 2017-12/CVE-2017-5456\n  Sandbox escape allowing local file system access\n* MFSA 2017-12/CVE-2017-5451\n  Addressbar spoofing with onblur event\n\n","status":"published","published":"2017-06-26T06:11:53Z","modified":"2026-02-04T02:38:40.390542Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:2235-1","title":"Security update for MozillaFirefox, MozillaFirefox-branding-SLED, firefox-gcc5, mozilla-nss","description":"This update for MozillaFirefox and mozilla-nss fixes the following issues:\n\nSecurity issues fixed:\n- Fixes in Firefox ESR 52.2 (bsc#1043960,MFSA 2017-16)\n  - CVE-2017-7758: Out-of-bounds read in Opus encoder\n  - CVE-2017-7749: Use-after-free during docshell reloading\n  - CVE-2017-7751: Use-after-free with content viewer listeners\n  - CVE-2017-5472: Use-after-free using destroyed node when regenerating trees\n  - CVE-2017-5470: Memory safety bugs fixed in Firefox 54 and Firefox ESR 52.2\n  - CVE-2017-7752: Use-after-free with IME input\n  - CVE-2017-7750: Use-after-free with track elements\n  - CVE-2017-7768: 32 byte arbitrary file read through Mozilla Maintenance Service\n  - CVE-2017-7778: Vulnerabilities in the Graphite 2 library\n  - CVE-2017-7754: Out-of-bounds read in WebGL with ImageInfo object\n  - CVE-2017-7755: Privilege escalation through Firefox Installer with same directory DLL files\n  - CVE-2017-7756: Use-after-free and use-after-scope logging XHR header errors\n  - CVE-2017-7757: Use-after-free in IndexedDB\n  - CVE-2017-7761: File deletion and privilege escalation through Mozilla Maintenance Service helper.exe application\n  - CVE-2017-7763: Mac fonts render some unicode characters as spaces\n  - CVE-2017-7765: Mark of the Web bypass when saving executable files\n  - CVE-2017-7764: Domain spoofing with combination of Canadian Syllabics and other unicode blocks\n\n- update to Firefox ESR 52.1 (bsc#1035082,MFSA 2017-12)\n  - CVE-2016-10196: Vulnerabilities in Libevent library\n  - CVE-2017-5443: Out-of-bounds write during BinHex decoding\n  - CVE-2017-5429: Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1\n  - CVE-2017-5464: Memory corruption with accessibility and DOM manipulation\n  - CVE-2017-5465: Out-of-bounds read in ConvolvePixel\n  - CVE-2017-5466: Origin confusion when reloading isolated data:text/html URL\n  - CVE-2017-5467: Memory corruption when drawing Skia content\n  - CVE-2017-5460: Use-after-free in frame selection\n  - CVE-2017-5461: Out-of-bounds write in Base64 encoding in NSS\n  - CVE-2017-5448: Out-of-bounds write in ClearKeyDecryptor\n  - CVE-2017-5449: Crash during bidirectional unicode manipulation with animation\n  - CVE-2017-5446: Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data\n  - CVE-2017-5447: Out-of-bounds read during glyph processing\n  - CVE-2017-5444: Buffer overflow while parsing application/http-index-format content\n  - CVE-2017-5445: Uninitialized values used while parsing application/http- index-format content\n  - CVE-2017-5442: Use-after-free during style changes\n  - CVE-2017-5469: Potential Buffer overflow in flex-generated code\n  - CVE-2017-5440: Use-after-free in txExecutionState destructor during XSLT processing\n  - CVE-2017-5441: Use-after-free with selection during scroll events\n  - CVE-2017-5439: Use-after-free in nsTArray Length() during XSLT processing\n  - CVE-2017-5438: Use-after-free in nsAutoPtr during XSLT processing\n  - CVE-2017-5436: Out-of-bounds write with malicious font in Graphite 2\n  - CVE-2017-5435: Use-after-free during transaction processing in the editor\n  - CVE-2017-5434: Use-after-free during focus handling\n  - CVE-2017-5433: Use-after-free in SMIL animation functions\n  - CVE-2017-5432: Use-after-free in text input selection\n  - CVE-2017-5430: Memory safety bugs fixed in Firefox 53 and Firefox ESR 52.1\n  - CVE-2017-5459: Buffer overflow in WebGL\n  - CVE-2017-5462: DRBG flaw in NSS\n  - CVE-2017-5455: Sandbox escape through internal feed reader APIs\n  - CVE-2017-5454: Sandbox escape allowing file system read access through file picker\n  - CVE-2017-5456: Sandbox escape allowing local file system access\n  - CVE-2017-5451: Addressbar spoofing with onblur event\n\n- General\n  - CVE-2015-5276: Fix for C++11 std::random_device short reads (bsc#945842)\n\nBugfixes:\n- workaround for Firefox hangs (bsc#1031485, bsc#1025108)\n- Update to gcc-5-branch head.\n  * Includes fixes for (bsc#966220), (bsc#962765), (bsc#964468), (bsc#939460),\n    (bsc#930496), (bsc#930392) and (bsc#955382).\n- Add fix to revert accidential libffi ABI breakage on AARCH64. (bsc#968771)\n- Build s390[x] with --with-tune=z9-109 --with-arch=z900 on SLE11 again. (bsc#954002)\n- Fix libffi include install.  (bsc#935510)\n","status":"published","published":"2017-08-22T13:32:21Z","modified":"2026-02-04T04:31:54.291589Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}