Skip to content
OpenAdvisories
Unscored CVE-2017-7796 EUVD-2017-16771GHSA-vqcv-9479-342r

On Windows systems, the logger run by the Windows updater deletes the file "update.log" before it runs in order to write a new log of that …

Published Jun 11, 2018 · Updated Aug 5, 2024 · Assigned by mozilla

Description

On Windows systems, the logger run by the Windows updater deletes the file "update.log" before it runs in order to write a new log of that name. The path to this file is supplied at the command line to the updater and could be used in concert with another local exploit to delete a different file named "update.log" instead of the one intended. Note: This attack only affects Windows operating systems. Other operating systems are not affected. This vulnerability affects Firefox < 55.

Affected products

VendorProductAffectedFixed
Mozilla Firefox unspecified – < 55 55

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
openSUSE Tumbleweed MozillaFirefox 92.0-1.2 openSUSE-SU-2024:10600-1
openSUSE Tumbleweed firefox-esr 128.5.1-1.1 openSUSE-SU-2024:14572-1

Advisories 3

References