Read the docs
TI-2017-05412 Aliases CVE-2017-7794GHSA-p52p-vjgp-j832

Incorrect default permissions in Mozilla Firefox

Priority LOW 34CWE-276Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA.

Summary

On Linux systems, if the content process is compromised, the sandbox broker will allow files to be truncated even though the sandbox explicitly only has read access to the local file system and no write permissions. Note: This attack only affects the Linux operating system. Other operating systems are not affected. This vulnerability affects Firefox < 55.

Why it matters now

EPSS 0.00326 25th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Firefox (Mozilla): 55

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MozillaFirefoxbefore 5555Patch availableCNA
  • Firefox VendorMozilla Affected before 55 Fixed in 55 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*before 55.0VulnerableMozilla
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*not specified by NVDRunning onLinux
  • cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* Versions before 55.0 Vulnerable ·Mozilla
  • cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux

Remediation

  • Fix · CNA Firefox (Mozilla) Fixed in 55

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Mozilla Firefox 55

    14 records Highest priority Priority MEDIUM 3 MEDIUM, 11 LOW

    Other records, highest priority first

    • TI-2017-05401 Improper input validation in Mozilla FirefoxPriority MEDIUM 48
    • TI-2017-05406 Injection in Mozilla FirefoxPriority MEDIUM 46
    • TI-2017-05398 Memory corruption in Mozilla FirefoxPriority MEDIUM 46
    Show all 14 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 2 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-7794
  2. 2026-10-03 Alias added: GHSA-p52p-vjgp-j832

References

Exploit 1

Advisory 1

  • TI-2024-08981 Use after free in Mozilla Firefox KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-09832 Use after free in Mozilla Firefox KEVCVSS 3.1CRITICAL 9.6
  • TI-2019-08769 Improper input validation in Mozilla Firefox ESR KEVCVSS 3.1CRITICAL 10.0
  • TI-2010-03577 Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-04799 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
  • TI-2023-04477 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
See all 3444 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences