RHSA-2017:0498

Vulnerability from csaf_opensuse - Published: 2017-03-14 00:00 - Updated: 2026-09-20 10:58
Summary
security update for thunderbird
Severity
Important
Notes
Title of the patch: security update for thunderbird
Description of the patch: This security update provides a functional equivalent of RHSA-2017:0498. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2017:0498.
Patchnames: RHSA-2017:0498
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2017-5398
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2017-5400
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 1 product, the same list as for CVE-2017-5398
Threats
Impact moderate
CVE-2017-5401
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 1 product, the same list as for CVE-2017-5398
Threats
Impact moderate
CVE-2017-5402
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 1 product, the same list as for CVE-2017-5398
Threats
Impact moderate
CVE-2017-5404
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 1 product, the same list as for CVE-2017-5398
Threats
Impact moderate
CVE-2017-5405
5.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Recommended 1 product, the same list as for CVE-2017-5398
Threats
Impact moderate
CVE-2017-5407
6.5 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected products
Recommended 1 product, the same list as for CVE-2017-5398
Threats
Impact moderate
CVE-2017-5408
5.3 (Medium)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Recommended 1 product, the same list as for CVE-2017-5398
Threats
Impact moderate
CVE-2017-5410
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 1 product, the same list as for CVE-2017-5398
Threats
Impact moderate
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/r… self
https://www.suse.com/security/cve/CVE-2017-5398/ self
https://www.suse.com/security/cve/CVE-2017-5400/ self
https://www.suse.com/security/cve/CVE-2017-5401/ self
https://www.suse.com/security/cve/CVE-2017-5402/ self
https://www.suse.com/security/cve/CVE-2017-5404/ self
https://www.suse.com/security/cve/CVE-2017-5405/ self
https://www.suse.com/security/cve/CVE-2017-5407/ self
https://www.suse.com/security/cve/CVE-2017-5408/ self
https://www.suse.com/security/cve/CVE-2017-5410/ self
https://www.suse.com/security/cve/CVE-2017-5398 external
https://bugzilla.suse.com/1028391 external
https://bugzilla.suse.com/1028393 external
https://www.suse.com/security/cve/CVE-2017-5400 external
https://bugzilla.suse.com/1028391 external
https://bugzilla.suse.com/1028393 external
https://www.suse.com/security/cve/CVE-2017-5401 external
https://bugzilla.suse.com/1028391 external
https://bugzilla.suse.com/1028393 external
https://www.suse.com/security/cve/CVE-2017-5402 external
https://bugzilla.suse.com/1028391 external
https://bugzilla.suse.com/1028393 external
https://www.suse.com/security/cve/CVE-2017-5404 external
https://bugzilla.suse.com/1028391 external
https://bugzilla.suse.com/1028393 external
https://www.suse.com/security/cve/CVE-2017-5405 external
https://bugzilla.suse.com/1028391 external
https://bugzilla.suse.com/1028393 external
https://www.suse.com/security/cve/CVE-2017-5407 external
https://bugzilla.suse.com/1028391 external
https://bugzilla.suse.com/1028393 external
https://www.suse.com/security/cve/CVE-2017-5408 external
https://bugzilla.suse.com/1028391 external
https://bugzilla.suse.com/1028393 external
https://www.suse.com/security/cve/CVE-2017-5410 external
https://bugzilla.suse.com/1028391 external
https://bugzilla.suse.com/1028393 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "security update for thunderbird",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This security update provides a functional equivalent of RHSA-2017:0498.\nThe original Red Hat(R) advisory is available from the Red Hat web site at\nhttps://access.redhat.com/errata/RHSA-2017:0498.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "RHSA-2017:0498",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/rhsa-2017_0498.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5398 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5398/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5400 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5400/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5401 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5401/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5402 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5402/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5404 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5404/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5405 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5405/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5407 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5407/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5408 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5408/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-5410 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-5410/"
      }
    ],
    "title": "security update for thunderbird",
    "tracking": {
      "current_release_date": "2026-09-20T10:58:21Z",
      "generator": {
        "date": "2017-03-14T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "RHSA-2017:0498",
      "initial_release_date": "2017-03-14T00:00:00Z",
      "revision_history": [
        {
          "date": "2017-03-14T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T10:58:21Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "thunderbird-0:45.8.0-1.el7_3.x86_64",
                "product": {
                  "name": "thunderbird-0:45.8.0-1.el7_3.x86_64",
                  "product_id": "thunderbird-0:45.8.0-1.el7_3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/thunderbird@45.8.0-1.el7_3?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Liberty Linux 7",
                "product": {
                  "name": "SUSE Liberty Linux 7",
                  "product_id": "SUSE Liberty Linux 7",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sll:7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "thunderbird-0:45.8.0-1.el7_3.x86_64 as component of SUSE Liberty Linux 7",
          "product_id": "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
        },
        "product_reference": "thunderbird-0:45.8.0-1.el7_3.x86_64",
        "relates_to_product_reference": "SUSE Liberty Linux 7"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2017-5398",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5398"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Memory safety bugs were reported in Thunderbird 45.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox \u003c 52, Firefox ESR \u003c 45.8, Thunderbird \u003c 52, and Thunderbird \u003c 45.8.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5398",
          "url": "https://www.suse.com/security/cve/CVE-2017-5398"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1028391 for CVE-2017-5398",
          "url": "https://bugzilla.suse.com/1028391"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1028393 for CVE-2017-5398",
          "url": "https://bugzilla.suse.com/1028393"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-03-14T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-5398"
    },
    {
      "cve": "CVE-2017-5400",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5400"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Firefox \u003c 52, Firefox ESR \u003c 45.8, Thunderbird \u003c 52, and Thunderbird \u003c 45.8.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5400",
          "url": "https://www.suse.com/security/cve/CVE-2017-5400"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1028391 for CVE-2017-5400",
          "url": "https://bugzilla.suse.com/1028391"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1028393 for CVE-2017-5400",
          "url": "https://bugzilla.suse.com/1028393"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-03-14T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-5400"
    },
    {
      "cve": "CVE-2017-5401",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5401"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A crash triggerable by web content in which an \"ErrorResult\" references unassigned memory due to a logic error. The resulting crash may be exploitable. This vulnerability affects Firefox \u003c 52, Firefox ESR \u003c 45.8, Thunderbird \u003c 52, and Thunderbird \u003c 45.8.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5401",
          "url": "https://www.suse.com/security/cve/CVE-2017-5401"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1028391 for CVE-2017-5401",
          "url": "https://bugzilla.suse.com/1028391"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1028393 for CVE-2017-5401",
          "url": "https://bugzilla.suse.com/1028393"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-03-14T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-5401"
    },
    {
      "cve": "CVE-2017-5402",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5402"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free can occur when events are fired for a \"FontFace\" object after the object has been already been destroyed while working with fonts. This results in a potentially exploitable crash. This vulnerability affects Firefox \u003c 52, Firefox ESR \u003c 45.8, Thunderbird \u003c 52, and Thunderbird \u003c 45.8.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5402",
          "url": "https://www.suse.com/security/cve/CVE-2017-5402"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1028391 for CVE-2017-5402",
          "url": "https://bugzilla.suse.com/1028391"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1028393 for CVE-2017-5402",
          "url": "https://bugzilla.suse.com/1028393"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-03-14T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-5402"
    },
    {
      "cve": "CVE-2017-5404",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5404"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of it. This results in a potentially exploitable crash. This vulnerability affects Firefox \u003c 52, Firefox ESR \u003c 45.8, Thunderbird \u003c 52, and Thunderbird \u003c 45.8.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5404",
          "url": "https://www.suse.com/security/cve/CVE-2017-5404"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1028391 for CVE-2017-5404",
          "url": "https://bugzilla.suse.com/1028391"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1028393 for CVE-2017-5404",
          "url": "https://bugzilla.suse.com/1028393"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-03-14T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-5404"
    },
    {
      "cve": "CVE-2017-5405",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5405"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations. This vulnerability affects Firefox \u003c 52, Firefox ESR \u003c 45.8, Thunderbird \u003c 52, and Thunderbird \u003c 45.8.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5405",
          "url": "https://www.suse.com/security/cve/CVE-2017-5405"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1028391 for CVE-2017-5405",
          "url": "https://bugzilla.suse.com/1028391"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1028393 for CVE-2017-5405",
          "url": "https://bugzilla.suse.com/1028393"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-03-14T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-5405"
    },
    {
      "cve": "CVE-2017-5407",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5407"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Using SVG filters that don\u0027t use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This can be used to extract history information and read text values across domains. This violates same-origin policy and leads to information disclosure. This vulnerability affects Firefox \u003c 52, Firefox ESR \u003c 45.8, Thunderbird \u003c 52, and Thunderbird \u003c 45.8.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5407",
          "url": "https://www.suse.com/security/cve/CVE-2017-5407"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1028391 for CVE-2017-5407",
          "url": "https://bugzilla.suse.com/1028391"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1028393 for CVE-2017-5407",
          "url": "https://bugzilla.suse.com/1028393"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-03-14T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-5407"
    },
    {
      "cve": "CVE-2017-5408",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5408"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for video captions. This vulnerability affects Firefox \u003c 52, Firefox ESR \u003c 45.8, Thunderbird \u003c 52, and Thunderbird \u003c 45.8.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5408",
          "url": "https://www.suse.com/security/cve/CVE-2017-5408"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1028391 for CVE-2017-5408",
          "url": "https://bugzilla.suse.com/1028391"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1028393 for CVE-2017-5408",
          "url": "https://bugzilla.suse.com/1028393"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-03-14T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-5408"
    },
    {
      "cve": "CVE-2017-5410",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-5410"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweeping is managed for memory cleanup. This vulnerability affects Firefox \u003c 52, Firefox ESR \u003c 45.8, Thunderbird \u003c 52, and Thunderbird \u003c 45.8.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-5410",
          "url": "https://www.suse.com/security/cve/CVE-2017-5410"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1028391 for CVE-2017-5410",
          "url": "https://bugzilla.suse.com/1028391"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1028393 for CVE-2017-5410",
          "url": "https://bugzilla.suse.com/1028393"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "SUSE Liberty Linux 7:thunderbird-0:45.8.0-1.el7_3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2017-03-14T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-5410"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.