10

CVE-2017-5397

EPSS 0.55%
Published 11.06.2018 21:29:03
Last modified 21.11.2024 03:27:31
Source security@mozilla.org
Teams watchlist Login
Open Login

The cache directory on the local file system is set to be world writable. Firefox defaults to extracting libraries from this cache. This allows for the possibility of an installed malicious application or tools with write access to the file system to replace files used by Firefox with their own versions. This vulnerability affects Firefox < 51.0.3.

Affected products Warnungen 0 Metrics 3 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Mozilla ≫ Firefox Version < 51.0.3

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.55%	0.669

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	10	10	10	AV:N/AC:L/Au:N/C:C/I:C/A:C

CWE-829 Inclusion of Functionality from Untrusted Control Sphere

The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

http://www.securityfocus.com/bid/96144

Third Party Advisory

VDB Entry

https://bugzilla.mozilla.org/show_bug.cgi?id=1337304

Patch

Vendor Advisory

Issue Tracking

https://www.mozilla.org/security/advisories/mfsa2017-04/

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2017-5397

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2017-5397

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2017-5397

EUVD