CVE-2017-7766

CVE-2017-7766 is a local privilege-escalation path in Windows Mozilla updater components. An attacker who already has local access can manipulate updater.ini to abuse the Mozilla Windows Updater and Mozilla Maintenance Service, gaining privileged access to execute arbitrary files or delete files....

CVE-2017-5409

The CVE-2017-5409 issue affects Mozilla Firefox on Windows (Firefox ESR <45.8 and Firefox

CVE-2016-5293

CVE-2016-5293 describes a local vulnerability in the Mozilla Updater on Windows: when the Updater log file in the working directory points to a hardlink, an attacker with local access can cause data to be appended to an arbitrary local file. Affected products include Firefox ESR older than 45.5 a...

CVE-2016-5294

The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Thunderbird 45.5, Firefox ESR...

CVE-2017-7760

The Mozilla Windows updater modifies some files to be updated by reading the original file and applying changes to it. The location of the original file can be altered by a malicious user by passing a special path to the callback parameter through the Mozilla Maintenance Service, allowing the...

CVE-2017-7768

The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the local system by convincing the service that it is reading a status file provided by the Mozilla Windows Updater. The Mozilla Maintenance Service executes with privileged access,...

CVE-2016-5294

CVE-2016-5294 : The Mozilla Updater can select an arbitrary target working directory for update-output files, requiring local access and restricting impact to Windows. Affected: Thunderbird < 45.5, Firefox ESR < 45.5, Firefox

CVE-2016-5294

The Mozilla Updater can be made to choose an arbitrary target working directory for output files resulting from the update process. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Thunderbird 45.5, Firefox ESR...

CVE-2017-7760

The Mozilla Windows updater modifies some files to be updated by reading the original file and applying changes to it. The location of the original file can be altered by a malicious user by passing a special path to the callback parameter through the Mozilla Maintenance Service, allowing the...

CVE-2017-7766

An attack using manipulation of "updater.ini" contents, used by the Mozilla Windows Updater, and privilege escalation through the Mozilla Maintenance Service to allow for arbitrary file execution and deletion by the Maintenance Service, which has privileged access. Note: This attack requires loca...

CVE-2017-7767

CVE-2017-7767 involves privilege escalation and arbitrary file overwrites via the Mozilla Windows Updater and Mozilla Maintenance Service on Windows. Affected products are Firefox ESR versions older than 52.2 and Firefox versions older than 54. The root cause is the update/maintenance components ...

CVE-2016-5293

When the Mozilla Updater is run, if the Updater's log file in the working directory points to a hardlink, data can be appended to an arbitrary local file. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Firefox E...

CVE-2017-5409

The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter through the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows...

CVE-2016-5293

When the Mozilla Updater is run, if the Updater's log file in the working directory points to a hardlink, data can be appended to an arbitrary local file. This vulnerability requires local system access. Note: this issue only affects Windows operating systems. This vulnerability affects Firefox E...

CVE-2017-7796

CVE-2017-7796 is a Windows-specific vulnerability in Mozilla Firefox prior to version 55 where the updater’s logger deletes update.log before writing a new log. The updater’s command-line argument specifies the log path, which could be abused with a local exploit to cause the deletion of a differ...

CVE-2017-7760

CVE-2017-7760 affects Mozilla Firefox/Firefox ESR on Windows via the Mozilla Windows Updater and Maintenance Service. The vulnerability stems from the updater reading the original file and applying changes, with a malicious actor able to pass a crafted path to the callback parameter, enabling man...

CVE-2017-7767

The Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary files with junk data using the Mozilla Windows Updater, which runs with the Maintenance Service's privileged access. Note: This attack requires local system access and only affects Windows. Other operati...

CVE-2017-7796

On Windows systems, the logger run by the Windows updater deletes the file "update.log" before it runs in order to write a new log of that name. The path to this file is supplied at the command line to the updater and could be used in concert with another local exploit to delete a different file...

FreeBSD : chromium -- vulnerability (36ff7a74-47b1-11e8-a7d6-54e1ad544088)

Google Chrome Releases reports : 62 security fixes in this release : - 826626 Critical CVE-2018-6085: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-28 - 827492 Critical CVE-2018-6086: Use after free in Disk Cache. Reported by Ned Williamson on 2018-03-30 - 813876 High...

Google Updater for MacOS Local Elevation of Privilege Vulnerability

Google Updater for MacOS is an update program for Google products based on the MacOS platform developed by Google USA. A local elevation of privilege vulnerability exists in Google Updater for MacOS, which stems from the program's unsafe use of Distributed Objects, and can be exploited by a local...