CVE-2017-7765

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The "Mark of the Web" was not correctly saved on Windows when files with very long names were downloaded from the Internet. Without the Mark of the Web data, the security warning that Windows displays before running executables downloaded from the Internet is not shown. Note: This attack only affects Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Jun 11, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-77667.8An attack using manipulation of "updater.ini" contents, used by the Mozilla Windows Updater, and privilege escalation through the Mozilla MaCVE-2017-77675.5The Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary files with junk data using the Mozilla WindowsCVE-2017-77685.5The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the local system by convincCVE-2017-77705.9A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar will not be rendereCVE-2017-77718.1Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Pass::readPass function.CVE-2017-77728.8Heap-based Buffer Overflow in Graphite2 library in Firefox before 54 in lz4::decompress function.CVE-2017-77738.8Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54 in lz4::decompress src/Decompressor.CVE-2017-77749.1Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Silf::readGraphite function.CVE-2017-77768.1Heap-based Buffer Overflow read in Graphite2 library in Firefox before 54 in graphite2::Silf::getClassGlyph.CVE-2017-77778.8Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function.CVE-2017-77789.8A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use CVE-2017-77799.8Memory safety bugs were reported in Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2. Some of these bugs showed evidence of memory corrupt
CVE-2017-7765: High severity, CVSS 7.5 | Vulnix