CVE-2017-7794 - Mozilla: Linux file truncation via sandbox broker (MFSA 2017-18)

Back Back to CVE browser

HIGH

Mozilla: Linux file truncation via sandbox broker (MFSA 2017-18)

Published Jun 11, 2018

7.8

HIGH

CVSS 3.0

EPSS 0.34%

Description

On Linux systems, if the content process is compromised, the sandbox broker will allow files to be truncated even though the sandbox explicitly only has read access to the local file system and no write permissions. Note: This attack only affects the Linux operating system. Other operating systems are not affected. This vulnerability affects Firefox < 55.

Affected products

Vendor Mozilla Product Firefox Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <55

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mozilla

Firefox

n/a

Version	Status	Constraints
unspecified	affected	<55

Red Hat Enterprise Linux 6

firefox

Not affected
Red Hat Enterprise Linux 7

firefox

Not affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 6	firefox	Not affected	n/a
Red Hat Enterprise Linux 7	firefox	Not affected	n/a

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-250

Execution with Unnecessary Privileges

CWE-276

Incorrect Default Permissions

References (8)

http://www.securitytracker.com/id/1039124
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2017-7794
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1374281
x_refsource_CONFIRMExploitIssue TrackingVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1479211
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-7794
https://www.cve.org/CVERecord?id=CVE-2017-7794
https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7794
https://www.mozilla.org/security/advisories/mfsa2017-18/
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
http://www.securitytracker.com/id/1039124		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2017-7794		Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1374281		x_refsource_CONFIRMExploitIssue TrackingVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1479211		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-7794
https://www.cve.org/CVERecord?id=CVE-2017-7794
https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7794
https://www.mozilla.org/security/advisories/mfsa2017-18/		x_refsource_CONFIRMVendor Advisory