CVE-2017-7796

On Windows systems, the logger run by the Windows updater deletes the file "update.log" before it runs in order to write a new log of that name. The path to this file is supplied at the command line to the updater and could be used in concert with another local exploit to delete a different file named "update.log" instead of the one intended. Note: This attack only affects Windows operating systems. Other operating systems are not affected. This vulnerability affects Firefox < 55.

• CWE-20

• http://www.securitytracker.com/id/1039124Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1234401Issue Tracking, Patch, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2017-18/Vendor Advisory
• http://www.securitytracker.com/id/1039124Third Party Advisory, VDB Entry
• https://bugzilla.mozilla.org/show_bug.cgi?id=1234401Issue Tracking, Patch, Vendor Advisory
• https://www.mozilla.org/security/advisories/mfsa2017-18/Vendor Advisory

Published

Jun 11, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-7789If a server sends two Strict-Transport-Security (STS) header…
• CVE-2017-7790On Windows systems, if non-null-terminated strings are copie…
• CVE-2017-7791On pages containing an iframe, the "data:" protocol can be u…
• CVE-2017-7792A buffer overflow will occur when viewing a certificate in t…
• CVE-2017-7793A use-after-free vulnerability can occur in the Fetch API wh…
• CVE-2017-7794On Linux systems, if the content process is compromised, the…
• CVE-2017-7797Response header name interning does not have same-origin pro…
• CVE-2017-7798The Developer Tools feature suffers from a XUL injection vul…
• CVE-2017-7799JavaScript in the "about:webrtc" page is not sanitized prope…
• CVE-2017-7800A use-after-free vulnerability can occur in WebSockets when …
• CVE-2017-7801A use-after-free vulnerability can occur while re-computing …
• CVE-2017-7802A use-after-free vulnerability can occur when manipulating t…