CVE-2017-7804
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The destructor function for the "WindowsDllDetourPatcher" class can be re-purposed by malicious code in concert with another vulnerability to write arbitrary data to an attacker controlled location in memory. This can be used to bypass existing memory protections in this situation. Note: This attack only affects Windows operating systems. Other operating systems are not affected. This vulnerability affects Thunderbird < 52.3, Firefox ESR < 52.3, and Firefox < 55.
La función destructor para la clase "WindowsDllDetourPatcher" puede ser reutilizada por un código malicioso junto con otra vulnerabilidad para introducir datos arbitrarios a una ubicación controlada por el atacante en la memoria. Esto se puede utilizar para omitir las protecciones de memoria existentes en esta situación. Nota: Este ataque solo afecta a sistemas operativos Windows. Los otros sistemas operativos no se ven afectados. Esta vulnerabilidad afecta a las versiones anteriores a la 52.3 de Thunderbird, las versiones anteriores a la 52.3 de Firefox ESR y las versiones anteriores a la 55 de Firefox.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-04-12 CVE Reserved
- 2018-06-11 CVE Published
- 2024-08-05 CVE Updated
- 2024-12-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (6)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/100234 | Third Party Advisory | |
| http://www.securitytracker.com/id/1039124 | Third Party Advisory | |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1372849 | Issue Tracking |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.mozilla.org/security/advisories/mfsa2017-18 | 2018-08-06 | |
| https://www.mozilla.org/security/advisories/mfsa2017-19 | 2018-08-06 | |
| https://www.mozilla.org/security/advisories/mfsa2017-20 | 2018-08-06 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mozilla Search vendor "Mozilla" | Firefox Search vendor "Mozilla" for product "Firefox" | < 55.0 Search vendor "Mozilla" for product "Firefox" and version " < 55.0" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Mozilla Search vendor "Mozilla" | Firefox Esr Search vendor "Mozilla" for product "Firefox Esr" | < 52.3.0 Search vendor "Mozilla" for product "Firefox Esr" and version " < 52.3.0" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|
| Mozilla Search vendor "Mozilla" | Thunderbird Search vendor "Mozilla" for product "Thunderbird" | < 52.3.0 Search vendor "Mozilla" for product "Thunderbird" and version " < 52.3.0" | - |
Affected
| in | Microsoft Search vendor "Microsoft" | Windows Search vendor "Microsoft" for product "Windows" | - | - |
Safe
|