CVE-2017-7768

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the local system by convincing the service that it is reading a status file provided by the Mozilla Windows Updater. The Mozilla Maintenance Service executes with privileged access, bypassing system protections against unprivileged users. Note: This attack requires local system access and only affects Windows. Other operating systems are not affected. This vulnerability affects Firefox ESR < 52.2 and Firefox < 54.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-77705.9A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar will not be rendere CVE-2017-77718.1Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Pass::readPass function.CVE-2017-77728.8Heap-based Buffer Overflow in Graphite2 library in Firefox before 54 in lz4::decompress function.CVE-2017-77738.8Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54 in lz4::decompress src/Decompressor.CVE-2017-77749.1Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Silf::readGraphite function.CVE-2017-77768.1Heap-based Buffer Overflow read in Graphite2 library in Firefox before 54 in graphite2::Silf::getClassGlyph.CVE-2017-77778.8Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function.CVE-2017-77789.8A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use CVE-2017-77799.8Memory safety bugs were reported in Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2. Some of these bugs showed evidence of memory corrupt CVE-2017-77809.8Memory safety bugs were reported in Firefox 54. Some of these bugs showed evidence of memory corruption and we presume that with enough effo CVE-2017-77815.9An error occurs in the elliptic curve point addition algorithm that uses mixed Jacobian-affine coordinates where it can yield a result "POIN CVE-2017-77825.3An error in the "WindowsDllDetourPatcher" where a RWX ("Read/Write/Execute") 4k block is allocated but never protected, violating DEP protec