Vulnerability-Lookup

SUSE-SU-2017:1669-1

Vulnerability from csaf_suse - Published: 2017-06-26 06:11 - Updated: 2017-06-26 06:11

Summary

Security update for MozillaFirefox, MozillaFirefox-branding-SLE

Severity

Important

Notes

Title of the patch: Security update for MozillaFirefox, MozillaFirefox-branding-SLE

Description of the patch: The MozillaFirefox was updated to the new ESR 52.2 release, which fixes the following issues (bsc#1043960): * MFSA 2017-16/CVE-2017-7758 Out-of-bounds read in Opus encoder * MFSA 2017-16/CVE-2017-7749 Use-after-free during docshell reloading * MFSA 2017-16/CVE-2017-7751 Use-after-free with content viewer listeners * MFSA 2017-16/CVE-2017-5472 Use-after-free using destroyed node when regenerating trees * MFSA 2017-16/CVE-2017-5470 Memory safety bugs fixed in Firefox 54 and Firefox ESR 52.2 * MFSA 2017-16/CVE-2017-7752 Use-after-free with IME input * MFSA 2017-16/CVE-2017-7750 Use-after-free with track elements * MFSA 2017-16/CVE-2017-7768 32 byte arbitrary file read through Mozilla Maintenance Service * MFSA 2017-16/CVE-2017-7778 Vulnerabilities in the Graphite 2 library * MFSA 2017-16/CVE-2017-7754 Out-of-bounds read in WebGL with ImageInfo object * MFSA 2017-16/CVE-2017-7755 Privilege escalation through Firefox Installer with same directory DLL files * MFSA 2017-16/CVE-2017-7756 Use-after-free and use-after-scope logging XHR header errors * MFSA 2017-16/CVE-2017-7757 Use-after-free in IndexedDB * MFSA 2017-16/CVE-2017-7761 File deletion and privilege escalation through Mozilla Maintenance Service helper.exe application * MFSA 2017-16/CVE-2017-7763 Mac fonts render some unicode characters as spaces * MFSA 2017-16/CVE-2017-7765 Mark of the Web bypass when saving executable files * MFSA 2017-16/CVE-2017-7764 (bmo#1364283, bmo#http://www.unicode.org/reports/tr31/tr31-26 .html#Aspirational_Use_Scripts) Domain spoofing with combination of Canadian Syllabics and other unicode blocks - update to Firefox ESR 52.1 (bsc#1035082) * MFSA 2017-12/CVE-2016-10196 Vulnerabilities in Libevent library * MFSA 2017-12/CVE-2017-5443 Out-of-bounds write during BinHex decoding * MFSA 2017-12/CVE-2017-5429 Memory safety bugs fixed in Firefox 53, Firefox ESR 45.9, and Firefox ESR 52.1 * MFSA 2017-12/CVE-2017-5464 Memory corruption with accessibility and DOM manipulation * MFSA 2017-12/CVE-2017-5465 Out-of-bounds read in ConvolvePixel * MFSA 2017-12/CVE-2017-5466 Origin confusion when reloading isolated data:text/html URL * MFSA 2017-12/CVE-2017-5467 Memory corruption when drawing Skia content * MFSA 2017-12/CVE-2017-5460 Use-after-free in frame selection * MFSA 2017-12/CVE-2017-5461 Out-of-bounds write in Base64 encoding in NSS * MFSA 2017-12/CVE-2017-5448 Out-of-bounds write in ClearKeyDecryptor * MFSA 2017-12/CVE-2017-5449 Crash during bidirectional unicode manipulation with animation * MFSA 2017-12/CVE-2017-5446 Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data * MFSA 2017-12/CVE-2017-5447 Out-of-bounds read during glyph processing * MFSA 2017-12/CVE-2017-5444 Buffer overflow while parsing application/http-index-format content * MFSA 2017-12/CVE-2017-5445 Uninitialized values used while parsing application/http- index-format content * MFSA 2017-12/CVE-2017-5442 Use-after-free during style changes * MFSA 2017-12/CVE-2017-5469 Potential Buffer overflow in flex-generated code * MFSA 2017-12/CVE-2017-5440 Use-after-free in txExecutionState destructor during XSLT processing * MFSA 2017-12/CVE-2017-5441 Use-after-free with selection during scroll events * MFSA 2017-12/CVE-2017-5439 Use-after-free in nsTArray Length() during XSLT processing * MFSA 2017-12/CVE-2017-5438 Use-after-free in nsAutoPtr during XSLT processing * MFSA 2017-12/CVE-2017-5436 Out-of-bounds write with malicious font in Graphite 2 * MFSA 2017-12/CVE-2017-5435 Use-after-free during transaction processing in the editor * MFSA 2017-12/CVE-2017-5434 Use-after-free during focus handling * MFSA 2017-12/CVE-2017-5433 Use-after-free in SMIL animation functions * MFSA 2017-12/CVE-2017-5432 Use-after-free in text input selection * MFSA 2017-12/CVE-2017-5430 Memory safety bugs fixed in Firefox 53 and Firefox ESR 52.1 * MFSA 2017-12/CVE-2017-5459 Buffer overflow in WebGL * MFSA 2017-12/CVE-2017-5462 DRBG flaw in NSS * MFSA 2017-12/CVE-2017-5455 Sandbox escape through internal feed reader APIs * MFSA 2017-12/CVE-2017-5454 Sandbox escape allowing file system read access through file picker * MFSA 2017-12/CVE-2017-5456 Sandbox escape allowing local file system access * MFSA 2017-12/CVE-2017-5451 Addressbar spoofing with onblur event

Patchnames: SUSE-OpenStack-Cloud-6-2017-1035,SUSE-SLE-DESKTOP-12-SP2-2017-1035,SUSE-SLE-RPI-12-SP2-2017-1035,SUSE-SLE-SAP-12-2017-1035,SUSE-SLE-SAP-12-SP1-2017-1035,SUSE-SLE-SDK-12-SP2-2017-1035,SUSE-SLE-SERVER-12-2017-1035,SUSE-SLE-SERVER-12-SP1-2017-1035,SUSE-SLE-SERVER-12-SP2-2017-1035

CVE-2016-10196

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 74 products

Product	Version	Remediation
Unresolved product id: SUSE Linux Enterprise Desktop 12 SP2:MozillaFirefox-52.2.0esr-108.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 12 SP2:MozillaFirefox-branding-SLE-52-31.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Desktop 12 SP2:MozillaFirefox-translations-52.2.0esr-108.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:MozillaFirefox-52.2.0esr-108.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:MozillaFirefox-52.2.0esr-108.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:MozillaFirefox-52.2.0esr-108.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:MozillaFirefox-branding-SLE-52-31.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:MozillaFirefox-branding-SLE-52-31.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:MozillaFirefox-branding-SLE-52-31.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:MozillaFirefox-devel-52.2.0esr-108.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:MozillaFirefox-devel-52.2.0esr-108.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:MozillaFirefox-devel-52.2.0esr-108.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:MozillaFirefox-translations-52.2.0esr-108.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:MozillaFirefox-translations-52.2.0esr-108.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP1-LTSS:MozillaFirefox-translations-52.2.0esr-108.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2:MozillaFirefox-52.2.0esr-108.3.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2:MozillaFirefox-52.2.0esr-108.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2:MozillaFirefox-52.2.0esr-108.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2:MozillaFirefox-52.2.0esr-108.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2:MozillaFirefox-branding-SLE-52-31.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2:MozillaFirefox-branding-SLE-52-31.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2:MozillaFirefox-branding-SLE-52-31.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2:MozillaFirefox-branding-SLE-52-31.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2:MozillaFirefox-translations-52.2.0esr-108.3.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2:MozillaFirefox-translations-52.2.0esr-108.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2:MozillaFirefox-translations-52.2.0esr-108.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12 SP2:MozillaFirefox-translations-52.2.0esr-108.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12-LTSS:MozillaFirefox-52.2.0esr-108.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12-LTSS:MozillaFirefox-52.2.0esr-108.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12-LTSS:MozillaFirefox-52.2.0esr-108.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12-LTSS:MozillaFirefox-branding-SLE-52-31.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12-LTSS:MozillaFirefox-branding-SLE-52-31.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12-LTSS:MozillaFirefox-branding-SLE-52-31.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12-LTSS:MozillaFirefox-devel-52.2.0esr-108.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12-LTSS:MozillaFirefox-devel-52.2.0esr-108.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12-LTSS:MozillaFirefox-devel-52.2.0esr-108.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12-LTSS:MozillaFirefox-translations-52.2.0esr-108.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12-LTSS:MozillaFirefox-translations-52.2.0esr-108.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server 12-LTSS:MozillaFirefox-translations-52.2.0esr-108.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:MozillaFirefox-52.2.0esr-108.3.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:MozillaFirefox-branding-SLE-52-31.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:MozillaFirefox-translations-52.2.0esr-108.3.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:MozillaFirefox-52.2.0esr-108.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:MozillaFirefox-52.2.0esr-108.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:MozillaFirefox-branding-SLE-52-31.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:MozillaFirefox-branding-SLE-52-31.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:MozillaFirefox-devel-52.2.0esr-108.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:MozillaFirefox-devel-52.2.0esr-108.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:MozillaFirefox-translations-52.2.0esr-108.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP1:MozillaFirefox-translations-52.2.0esr-108.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP2:MozillaFirefox-52.2.0esr-108.3.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP2:MozillaFirefox-52.2.0esr-108.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP2:MozillaFirefox-52.2.0esr-108.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP2:MozillaFirefox-52.2.0esr-108.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP2:MozillaFirefox-branding-SLE-52-31.1.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP2:MozillaFirefox-branding-SLE-52-31.1.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP2:MozillaFirefox-branding-SLE-52-31.1.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP2:MozillaFirefox-branding-SLE-52-31.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP2:MozillaFirefox-translations-52.2.0esr-108.3.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP2:MozillaFirefox-translations-52.2.0esr-108.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP2:MozillaFirefox-translations-52.2.0esr-108.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12 SP2:MozillaFirefox-translations-52.2.0esr-108.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:MozillaFirefox-52.2.0esr-108.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:MozillaFirefox-branding-SLE-52-31.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:MozillaFirefox-devel-52.2.0esr-108.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Server for SAP Applications 12:MozillaFirefox-translations-52.2.0esr-108.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Software Development Kit 12 SP2:MozillaFirefox-devel-52.2.0esr-108.3.aarch64	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Software Development Kit 12 SP2:MozillaFirefox-devel-52.2.0esr-108.3.ppc64le	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Software Development Kit 12 SP2:MozillaFirefox-devel-52.2.0esr-108.3.s390x	—	Vendor Fix
Unresolved product id: SUSE Linux Enterprise Software Development Kit 12 SP2:MozillaFirefox-devel-52.2.0esr-108.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 6:MozillaFirefox-52.2.0esr-108.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 6:MozillaFirefox-branding-SLE-52-31.1.x86_64	—	Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 6:MozillaFirefox-devel-52.2.0esr-108.3.x86_64	—	Vendor Fix
Unresolved product id: SUSE OpenStack Cloud 6:MozillaFirefox-translations-52.2.0esr-108.3.x86_64	—	Vendor Fix

Threats

Impact moderate

CVE-2017-5429

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5430

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5432

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5433

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5434

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5435

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5436

8.8 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5438

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5439

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5440

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5441

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5442

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5443

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5444

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5445

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5446

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5447

9.1 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5448

8.6 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5449

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5451

4.3 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5454

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact low

CVE-2017-5455

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5456

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5459

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5460

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5461

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact important

CVE-2017-5462

5.3 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5464

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5465

9.1 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5466

6.1 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5467

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5469

9.8 (Critical)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact moderate

CVE-2017-5470

7.3 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact important

CVE-2017-5472

7.3 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact important

CVE-2017-7749

7.3 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact important

CVE-2017-7750

7.3 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact important

CVE-2017-7751

7.3 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact important

CVE-2017-7752

6.3 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact important

CVE-2017-7754

5.3 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact important

CVE-2017-7755

7.8 (High)


                
                  CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact important

CVE-2017-7756

7.3 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact important

CVE-2017-7757

7.3 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact important

CVE-2017-7758

6.5 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact important

CVE-2017-7761

5.5 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact important

CVE-2017-7763

5.3 (Medium)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact important

CVE-2017-7764

4.2 (Medium)


                
                  CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact important

CVE-2017-7765

7.5 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact important

CVE-2017-7768

5.5 (Medium)


                
                  CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact important

CVE-2017-7778

7.3 (High)


                
                  CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected products

Recommended 74 products, the same list as for CVE-2016-10196

Threats

Impact important

References

259 references

URL	Category
https://www.suse.com/support/security/rating/	external
https://ftp.suse.com/pub/projects/security/csaf/s…	self
https://www.suse.com/support/update/announcement/…	self
https://lists.suse.com/pipermail/sle-security-upd…	self
https://bugzilla.suse.com/1035082	self
https://bugzilla.suse.com/1043960	self
https://www.suse.com/security/cve/CVE-2016-10196/	self
https://www.suse.com/security/cve/CVE-2017-5429/	self
https://www.suse.com/security/cve/CVE-2017-5430/	self
https://www.suse.com/security/cve/CVE-2017-5432/	self
https://www.suse.com/security/cve/CVE-2017-5433/	self
https://www.suse.com/security/cve/CVE-2017-5434/	self
https://www.suse.com/security/cve/CVE-2017-5435/	self
https://www.suse.com/security/cve/CVE-2017-5436/	self
https://www.suse.com/security/cve/CVE-2017-5438/	self
https://www.suse.com/security/cve/CVE-2017-5439/	self
https://www.suse.com/security/cve/CVE-2017-5440/	self
https://www.suse.com/security/cve/CVE-2017-5441/	self
https://www.suse.com/security/cve/CVE-2017-5442/	self
https://www.suse.com/security/cve/CVE-2017-5443/	self
https://www.suse.com/security/cve/CVE-2017-5444/	self
https://www.suse.com/security/cve/CVE-2017-5445/	self
https://www.suse.com/security/cve/CVE-2017-5446/	self
https://www.suse.com/security/cve/CVE-2017-5447/	self
https://www.suse.com/security/cve/CVE-2017-5448/	self
https://www.suse.com/security/cve/CVE-2017-5449/	self
https://www.suse.com/security/cve/CVE-2017-5451/	self
https://www.suse.com/security/cve/CVE-2017-5454/	self
https://www.suse.com/security/cve/CVE-2017-5455/	self
https://www.suse.com/security/cve/CVE-2017-5456/	self
https://www.suse.com/security/cve/CVE-2017-5459/	self
https://www.suse.com/security/cve/CVE-2017-5460/	self
https://www.suse.com/security/cve/CVE-2017-5461/	self
https://www.suse.com/security/cve/CVE-2017-5462/	self
https://www.suse.com/security/cve/CVE-2017-5464/	self
https://www.suse.com/security/cve/CVE-2017-5465/	self
https://www.suse.com/security/cve/CVE-2017-5466/	self
https://www.suse.com/security/cve/CVE-2017-5467/	self
https://www.suse.com/security/cve/CVE-2017-5469/	self
https://www.suse.com/security/cve/CVE-2017-5470/	self
https://www.suse.com/security/cve/CVE-2017-5472/	self
https://www.suse.com/security/cve/CVE-2017-7749/	self
https://www.suse.com/security/cve/CVE-2017-7750/	self
https://www.suse.com/security/cve/CVE-2017-7751/	self
https://www.suse.com/security/cve/CVE-2017-7752/	self
https://www.suse.com/security/cve/CVE-2017-7754/	self
https://www.suse.com/security/cve/CVE-2017-7755/	self
https://www.suse.com/security/cve/CVE-2017-7756/	self
https://www.suse.com/security/cve/CVE-2017-7757/	self
https://www.suse.com/security/cve/CVE-2017-7758/	self
https://www.suse.com/security/cve/CVE-2017-7761/	self
https://www.suse.com/security/cve/CVE-2017-7763/	self
https://www.suse.com/security/cve/CVE-2017-7764/	self
https://www.suse.com/security/cve/CVE-2017-7765/	self
https://www.suse.com/security/cve/CVE-2017-7768/	self
https://www.suse.com/security/cve/CVE-2017-7778/	self
https://www.suse.com/security/cve/CVE-2016-10196	external
https://bugzilla.suse.com/1022918	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://bugzilla.suse.com/1075618	external
https://www.suse.com/security/cve/CVE-2017-5429	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5430	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5432	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5433	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5434	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5435	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5436	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035204	external
https://www.suse.com/security/cve/CVE-2017-5438	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5439	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5440	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5441	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5442	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5443	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5444	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5445	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5446	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5447	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5448	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5449	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5451	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5454	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5455	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5456	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5459	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5460	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5461	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5462	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5464	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5465	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5466	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5467	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5469	external
https://bugzilla.suse.com/1035082	external
https://bugzilla.suse.com/1035209	external
https://www.suse.com/security/cve/CVE-2017-5470	external
https://bugzilla.suse.com/1043960	external
https://bugzilla.suse.com/1044239	external
https://bugzilla.suse.com/1044240	external
https://bugzilla.suse.com/1044241	external
https://bugzilla.suse.com/1044242	external
https://www.suse.com/security/cve/CVE-2017-5472	external
https://bugzilla.suse.com/1043960	external
https://bugzilla.suse.com/1044239	external
https://bugzilla.suse.com/1044240	external
https://bugzilla.suse.com/1044241	external
https://bugzilla.suse.com/1044242	external
https://www.suse.com/security/cve/CVE-2017-7749	external
https://bugzilla.suse.com/1043960	external
https://bugzilla.suse.com/1044239	external
https://bugzilla.suse.com/1044240	external
https://bugzilla.suse.com/1044241	external
https://bugzilla.suse.com/1044242	external
https://www.suse.com/security/cve/CVE-2017-7750	external
https://bugzilla.suse.com/1043960	external
https://bugzilla.suse.com/1044239	external
https://bugzilla.suse.com/1044240	external
https://bugzilla.suse.com/1044241	external
https://bugzilla.suse.com/1044242	external
https://www.suse.com/security/cve/CVE-2017-7751	external
https://bugzilla.suse.com/1043960	external
https://bugzilla.suse.com/1044239	external
https://bugzilla.suse.com/1044240	external
https://bugzilla.suse.com/1044241	external
https://bugzilla.suse.com/1044242	external
https://www.suse.com/security/cve/CVE-2017-7752	external
https://bugzilla.suse.com/1043960	external
https://bugzilla.suse.com/1044239	external
https://bugzilla.suse.com/1044240	external
https://bugzilla.suse.com/1044241	external
https://bugzilla.suse.com/1044242	external
https://www.suse.com/security/cve/CVE-2017-7754	external
https://bugzilla.suse.com/1043960	external
https://bugzilla.suse.com/1044239	external
https://bugzilla.suse.com/1044240	external
https://bugzilla.suse.com/1044241	external
https://bugzilla.suse.com/1044242	external
https://www.suse.com/security/cve/CVE-2017-7755	external
https://bugzilla.suse.com/1043960	external
https://bugzilla.suse.com/1044239	external
https://bugzilla.suse.com/1044240	external
https://bugzilla.suse.com/1044241	external
https://bugzilla.suse.com/1044242	external
https://www.suse.com/security/cve/CVE-2017-7756	external
https://bugzilla.suse.com/1043960	external
https://bugzilla.suse.com/1044239	external
https://bugzilla.suse.com/1044240	external
https://bugzilla.suse.com/1044241	external
https://bugzilla.suse.com/1044242	external
https://www.suse.com/security/cve/CVE-2017-7757	external
https://bugzilla.suse.com/1043960	external
https://bugzilla.suse.com/1044239	external
https://bugzilla.suse.com/1044240	external
https://bugzilla.suse.com/1044241	external
https://bugzilla.suse.com/1044242	external
https://www.suse.com/security/cve/CVE-2017-7758	external
https://bugzilla.suse.com/1043960	external
https://bugzilla.suse.com/1044239	external
https://bugzilla.suse.com/1044240	external
https://bugzilla.suse.com/1044241	external
https://bugzilla.suse.com/1044242	external
https://www.suse.com/security/cve/CVE-2017-7761	external
https://bugzilla.suse.com/1043960	external
https://bugzilla.suse.com/1044239	external
https://bugzilla.suse.com/1044240	external
https://bugzilla.suse.com/1044241	external
https://bugzilla.suse.com/1044242	external
https://www.suse.com/security/cve/CVE-2017-7763	external
https://bugzilla.suse.com/1043960	external
https://bugzilla.suse.com/1044239	external
https://bugzilla.suse.com/1044240	external
https://bugzilla.suse.com/1044241	external
https://bugzilla.suse.com/1044242	external
https://www.suse.com/security/cve/CVE-2017-7764	external
https://bugzilla.suse.com/1043960	external
https://bugzilla.suse.com/1044239	external
https://bugzilla.suse.com/1044240	external
https://bugzilla.suse.com/1044241	external
https://bugzilla.suse.com/1044242	external
https://www.suse.com/security/cve/CVE-2017-7765	external
https://bugzilla.suse.com/1043960	external
https://bugzilla.suse.com/1044239	external
https://bugzilla.suse.com/1044240	external
https://bugzilla.suse.com/1044241	external
https://bugzilla.suse.com/1044242	external
https://www.suse.com/security/cve/CVE-2017-7768	external
https://bugzilla.suse.com/1043960	external
https://bugzilla.suse.com/1044239	external
https://bugzilla.suse.com/1044240	external
https://bugzilla.suse.com/1044241	external
https://bugzilla.suse.com/1044242	external
https://www.suse.com/security/cve/CVE-2017-7778	external
https://bugzilla.suse.com/1043960	external
https://bugzilla.suse.com/1044239	external
https://bugzilla.suse.com/1044240	external
https://bugzilla.suse.com/1044241	external
https://bugzilla.suse.com/1044242	external

JSON

To clipboard

Loading 1.3 MB of JSON…

CVE-2017-5440 (GCVE-0-2017-5440)

Vulnerability from cvelistv5 – Published: 2018-06-11 21:00 – Updated: 2024-08-05 15:04

Summary

A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating context, leading to objects being used when they no longer exist. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Severity

No CVSS data available.

CWE

Use-after-free in txExecutionState destructor during XSLT processing

Assigner

mozilla mitre root

References

11 references

URL	Tags
https://access.redhat.com/errata/RHSA-2017:1106	vendor-advisoryx_refsource_REDHAT
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/97940	vdb-entryx_refsource_BID
https://www.debian.org/security/2017/dsa-3831	vendor-advisoryx_refsource_DEBIAN
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
http://www.securitytracker.com/id/1038320	vdb-entryx_refsource_SECTRACK
https://bugzilla.mozilla.org/show_bug.cgi?id=1336832	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2017:1104	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:1201	vendor-advisoryx_refsource_REDHAT

Impacted products

3 products

Vendor	Product	Version
Mozilla	Thunderbird	Affected: unspecified , < 52.1 (custom)
Mozilla	Firefox ESR	Affected: unspecified , < 45.9 (custom) Affected: unspecified , < 52.1 (custom)
Mozilla	Firefox	Affected: unspecified , < 53 (custom)

Date Public

2017-04-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:04:14.254Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2017:1106",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1106"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
          },
          {
            "name": "97940",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97940"
          },
          {
            "name": "DSA-3831",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2017/dsa-3831"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
          },
          {
            "name": "1038320",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038320"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1336832"
          },
          {
            "name": "RHSA-2017:1104",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1104"
          },
          {
            "name": "RHSA-2017:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1201"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "52.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "45.9",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "52.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "53",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2017-04-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating context, leading to objects being used when they no longer exist. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Use-after-free in txExecutionState destructor during XSLT processing",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-12T09:57:01.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "RHSA-2017:1106",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1106"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
        },
        {
          "name": "97940",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97940"
        },
        {
          "name": "DSA-3831",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2017/dsa-3831"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
        },
        {
          "name": "1038320",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038320"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1336832"
        },
        {
          "name": "RHSA-2017:1104",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1104"
        },
        {
          "name": "RHSA-2017:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1201"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2017-5440",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Thunderbird",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "52.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "45.9"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "52.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "53"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating context, leading to objects being used when they no longer exist. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Use-after-free in txExecutionState destructor during XSLT processing"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2017:1106",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1106"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-12/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-11/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-10/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
            },
            {
              "name": "97940",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97940"
            },
            {
              "name": "DSA-3831",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2017/dsa-3831"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-13/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
            },
            {
              "name": "1038320",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038320"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1336832",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1336832"
            },
            {
              "name": "RHSA-2017:1104",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1104"
            },
            {
              "name": "RHSA-2017:1201",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1201"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2017-5440",
    "datePublished": "2018-06-11T21:00:00.000Z",
    "dateReserved": "2017-01-13T00:00:00.000Z",
    "dateUpdated": "2024-08-05T15:04:14.254Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-5441 (GCVE-0-2017-5441)

Vulnerability from cvelistv5 – Published: 2018-06-11 21:00 – Updated: 2024-08-05 15:04

Summary

A use-after-free vulnerability when holding a selection during scroll events. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Severity

No CVSS data available.

CWE

Use-after-free with selection during scroll events

Assigner

mozilla mitre root

References

11 references

URL	Tags
https://access.redhat.com/errata/RHSA-2017:1106	vendor-advisoryx_refsource_REDHAT
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/97940	vdb-entryx_refsource_BID
https://www.debian.org/security/2017/dsa-3831	vendor-advisoryx_refsource_DEBIAN
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
https://bugzilla.mozilla.org/show_bug.cgi?id=1343795	x_refsource_CONFIRM
http://www.securitytracker.com/id/1038320	vdb-entryx_refsource_SECTRACK
https://access.redhat.com/errata/RHSA-2017:1104	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:1201	vendor-advisoryx_refsource_REDHAT

Impacted products

3 products

Vendor	Product	Version
Mozilla	Thunderbird	Affected: unspecified , < 52.1 (custom)
Mozilla	Firefox ESR	Affected: unspecified , < 45.9 (custom) Affected: unspecified , < 52.1 (custom)
Mozilla	Firefox	Affected: unspecified , < 53 (custom)

Date Public

2017-04-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:04:14.383Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2017:1106",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1106"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
          },
          {
            "name": "97940",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97940"
          },
          {
            "name": "DSA-3831",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2017/dsa-3831"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1343795"
          },
          {
            "name": "1038320",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038320"
          },
          {
            "name": "RHSA-2017:1104",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1104"
          },
          {
            "name": "RHSA-2017:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1201"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "52.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "45.9",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "52.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "53",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2017-04-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A use-after-free vulnerability when holding a selection during scroll events. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Use-after-free with selection during scroll events",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-12T09:57:01.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "RHSA-2017:1106",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1106"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
        },
        {
          "name": "97940",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97940"
        },
        {
          "name": "DSA-3831",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2017/dsa-3831"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1343795"
        },
        {
          "name": "1038320",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038320"
        },
        {
          "name": "RHSA-2017:1104",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1104"
        },
        {
          "name": "RHSA-2017:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1201"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2017-5441",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Thunderbird",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "52.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "45.9"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "52.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "53"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A use-after-free vulnerability when holding a selection during scroll events. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Use-after-free with selection during scroll events"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2017:1106",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1106"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-12/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-11/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-10/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
            },
            {
              "name": "97940",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97940"
            },
            {
              "name": "DSA-3831",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2017/dsa-3831"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-13/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1343795",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1343795"
            },
            {
              "name": "1038320",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038320"
            },
            {
              "name": "RHSA-2017:1104",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1104"
            },
            {
              "name": "RHSA-2017:1201",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1201"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2017-5441",
    "datePublished": "2018-06-11T21:00:00.000Z",
    "dateReserved": "2017-01-13T00:00:00.000Z",
    "dateUpdated": "2024-08-05T15:04:14.383Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-5442 (GCVE-0-2017-5442)

Vulnerability from cvelistv5 – Published: 2018-06-11 21:00 – Updated: 2024-08-05 15:04

Summary

A use-after-free vulnerability during changes in style when manipulating DOM elements. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Severity

No CVSS data available.

CWE

Use-after-free during style changes

Assigner

mozilla mitre root

References

11 references

URL	Tags
https://bugzilla.mozilla.org/show_bug.cgi?id=1347979	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2017:1106	vendor-advisoryx_refsource_REDHAT
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/97940	vdb-entryx_refsource_BID
https://www.debian.org/security/2017/dsa-3831	vendor-advisoryx_refsource_DEBIAN
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
http://www.securitytracker.com/id/1038320	vdb-entryx_refsource_SECTRACK
https://access.redhat.com/errata/RHSA-2017:1104	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:1201	vendor-advisoryx_refsource_REDHAT

Impacted products

3 products

Vendor	Product	Version
Mozilla	Thunderbird	Affected: unspecified , < 52.1 (custom)
Mozilla	Firefox ESR	Affected: unspecified , < 45.9 (custom) Affected: unspecified , < 52.1 (custom)
Mozilla	Firefox	Affected: unspecified , < 53 (custom)

Date Public

2017-04-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:04:14.646Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1347979"
          },
          {
            "name": "RHSA-2017:1106",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1106"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
          },
          {
            "name": "97940",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97940"
          },
          {
            "name": "DSA-3831",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2017/dsa-3831"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
          },
          {
            "name": "1038320",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038320"
          },
          {
            "name": "RHSA-2017:1104",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1104"
          },
          {
            "name": "RHSA-2017:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1201"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "52.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "45.9",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "52.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "53",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2017-04-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A use-after-free vulnerability during changes in style when manipulating DOM elements. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Use-after-free during style changes",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-12T09:57:01.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1347979"
        },
        {
          "name": "RHSA-2017:1106",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1106"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
        },
        {
          "name": "97940",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97940"
        },
        {
          "name": "DSA-3831",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2017/dsa-3831"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
        },
        {
          "name": "1038320",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038320"
        },
        {
          "name": "RHSA-2017:1104",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1104"
        },
        {
          "name": "RHSA-2017:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1201"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2017-5442",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Thunderbird",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "52.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "45.9"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "52.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "53"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A use-after-free vulnerability during changes in style when manipulating DOM elements. This results in a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Use-after-free during style changes"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1347979",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1347979"
            },
            {
              "name": "RHSA-2017:1106",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1106"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-12/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-11/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-10/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
            },
            {
              "name": "97940",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97940"
            },
            {
              "name": "DSA-3831",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2017/dsa-3831"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-13/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
            },
            {
              "name": "1038320",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038320"
            },
            {
              "name": "RHSA-2017:1104",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1104"
            },
            {
              "name": "RHSA-2017:1201",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1201"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2017-5442",
    "datePublished": "2018-06-11T21:00:00.000Z",
    "dateReserved": "2017-01-13T00:00:00.000Z",
    "dateUpdated": "2024-08-05T15:04:14.646Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-5443 (GCVE-0-2017-5443)

Vulnerability from cvelistv5 – Published: 2018-06-11 21:00 – Updated: 2024-08-05 15:04

Summary

An out-of-bounds write vulnerability while decoding improperly formed BinHex format archives. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Severity

No CVSS data available.

CWE

Out-of-bounds write during BinHex decoding

Assigner

mozilla mitre root

References

11 references

URL	Tags
https://access.redhat.com/errata/RHSA-2017:1106	vendor-advisoryx_refsource_REDHAT
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
https://bugzilla.mozilla.org/show_bug.cgi?id=1342661	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/97940	vdb-entryx_refsource_BID
https://www.debian.org/security/2017/dsa-3831	vendor-advisoryx_refsource_DEBIAN
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
http://www.securitytracker.com/id/1038320	vdb-entryx_refsource_SECTRACK
https://access.redhat.com/errata/RHSA-2017:1104	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:1201	vendor-advisoryx_refsource_REDHAT

Impacted products

3 products

Vendor	Product	Version
Mozilla	Thunderbird	Affected: unspecified , < 52.1 (custom)
Mozilla	Firefox ESR	Affected: unspecified , < 45.9 (custom) Affected: unspecified , < 52.1 (custom)
Mozilla	Firefox	Affected: unspecified , < 53 (custom)

Date Public

2017-04-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:04:14.404Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2017:1106",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1106"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1342661"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
          },
          {
            "name": "97940",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97940"
          },
          {
            "name": "DSA-3831",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2017/dsa-3831"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
          },
          {
            "name": "1038320",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038320"
          },
          {
            "name": "RHSA-2017:1104",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1104"
          },
          {
            "name": "RHSA-2017:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1201"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "52.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "45.9",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "52.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "53",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2017-04-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An out-of-bounds write vulnerability while decoding improperly formed BinHex format archives. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Out-of-bounds write during BinHex decoding",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-12T09:57:01.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "RHSA-2017:1106",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1106"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1342661"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
        },
        {
          "name": "97940",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97940"
        },
        {
          "name": "DSA-3831",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2017/dsa-3831"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
        },
        {
          "name": "1038320",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038320"
        },
        {
          "name": "RHSA-2017:1104",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1104"
        },
        {
          "name": "RHSA-2017:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1201"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2017-5443",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Thunderbird",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "52.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "45.9"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "52.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "53"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An out-of-bounds write vulnerability while decoding improperly formed BinHex format archives. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Out-of-bounds write during BinHex decoding"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2017:1106",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1106"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-12/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-11/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1342661",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1342661"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-10/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
            },
            {
              "name": "97940",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97940"
            },
            {
              "name": "DSA-3831",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2017/dsa-3831"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-13/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
            },
            {
              "name": "1038320",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038320"
            },
            {
              "name": "RHSA-2017:1104",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1104"
            },
            {
              "name": "RHSA-2017:1201",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1201"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2017-5443",
    "datePublished": "2018-06-11T21:00:00.000Z",
    "dateReserved": "2017-01-13T00:00:00.000Z",
    "dateUpdated": "2024-08-05T15:04:14.404Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-5444 (GCVE-0-2017-5444)

Vulnerability from cvelistv5 – Published: 2018-06-11 21:00 – Updated: 2024-08-05 15:04

Summary

A buffer overflow vulnerability while parsing "application/http-index-format" format content when the header contains improperly formatted data. This allows for an out-of-bounds read of data from memory. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Severity

No CVSS data available.

CWE

Buffer overflow while parsing application/http-index-format content

Assigner

mozilla mitre root

References

11 references

URL	Tags
https://access.redhat.com/errata/RHSA-2017:1106	vendor-advisoryx_refsource_REDHAT
https://bugzilla.mozilla.org/show_bug.cgi?id=1344461	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/97940	vdb-entryx_refsource_BID
https://www.debian.org/security/2017/dsa-3831	vendor-advisoryx_refsource_DEBIAN
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
http://www.securitytracker.com/id/1038320	vdb-entryx_refsource_SECTRACK
https://access.redhat.com/errata/RHSA-2017:1104	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:1201	vendor-advisoryx_refsource_REDHAT

Impacted products

3 products

Vendor	Product	Version
Mozilla	Thunderbird	Affected: unspecified , < 52.1 (custom)
Mozilla	Firefox ESR	Affected: unspecified , < 45.9 (custom) Affected: unspecified , < 52.1 (custom)
Mozilla	Firefox	Affected: unspecified , < 53 (custom)

Date Public

2017-04-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:04:14.255Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2017:1106",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1106"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1344461"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
          },
          {
            "name": "97940",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97940"
          },
          {
            "name": "DSA-3831",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2017/dsa-3831"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
          },
          {
            "name": "1038320",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038320"
          },
          {
            "name": "RHSA-2017:1104",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1104"
          },
          {
            "name": "RHSA-2017:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1201"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "52.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "45.9",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "52.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "53",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2017-04-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A buffer overflow vulnerability while parsing \"application/http-index-format\" format content when the header contains improperly formatted data. This allows for an out-of-bounds read of data from memory. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Buffer overflow while parsing application/http-index-format content",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-12T09:57:01.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "RHSA-2017:1106",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1106"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1344461"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
        },
        {
          "name": "97940",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97940"
        },
        {
          "name": "DSA-3831",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2017/dsa-3831"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
        },
        {
          "name": "1038320",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038320"
        },
        {
          "name": "RHSA-2017:1104",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1104"
        },
        {
          "name": "RHSA-2017:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1201"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2017-5444",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Thunderbird",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "52.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "45.9"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "52.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "53"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A buffer overflow vulnerability while parsing \"application/http-index-format\" format content when the header contains improperly formatted data. This allows for an out-of-bounds read of data from memory. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Buffer overflow while parsing application/http-index-format content"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2017:1106",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1106"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1344461",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1344461"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-12/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-11/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-10/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
            },
            {
              "name": "97940",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97940"
            },
            {
              "name": "DSA-3831",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2017/dsa-3831"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-13/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
            },
            {
              "name": "1038320",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038320"
            },
            {
              "name": "RHSA-2017:1104",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1104"
            },
            {
              "name": "RHSA-2017:1201",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1201"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2017-5444",
    "datePublished": "2018-06-11T21:00:00.000Z",
    "dateReserved": "2017-01-13T00:00:00.000Z",
    "dateUpdated": "2024-08-05T15:04:14.255Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-5445 (GCVE-0-2017-5445)

Vulnerability from cvelistv5 – Published: 2018-06-11 21:00 – Updated: 2024-08-05 15:04

Summary

A vulnerability while parsing "application/http-index-format" format content where uninitialized values are used to create an array. This could allow the reading of uninitialized memory into the arrays affected. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Severity

No CVSS data available.

CWE

Uninitialized values used while parsing application/http-index-format content

Assigner

mozilla mitre root

References

11 references

URL	Tags
https://access.redhat.com/errata/RHSA-2017:1106	vendor-advisoryx_refsource_REDHAT
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/97940	vdb-entryx_refsource_BID
https://www.debian.org/security/2017/dsa-3831	vendor-advisoryx_refsource_DEBIAN
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
http://www.securitytracker.com/id/1038320	vdb-entryx_refsource_SECTRACK
https://access.redhat.com/errata/RHSA-2017:1104	vendor-advisoryx_refsource_REDHAT
https://bugzilla.mozilla.org/show_bug.cgi?id=1344467	x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2017:1201	vendor-advisoryx_refsource_REDHAT

Impacted products

3 products

Vendor	Product	Version
Mozilla	Thunderbird	Affected: unspecified , < 52.1 (custom)
Mozilla	Firefox ESR	Affected: unspecified , < 45.9 (custom) Affected: unspecified , < 52.1 (custom)
Mozilla	Firefox	Affected: unspecified , < 53 (custom)

Date Public

2017-04-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:04:13.330Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2017:1106",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1106"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
          },
          {
            "name": "97940",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97940"
          },
          {
            "name": "DSA-3831",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2017/dsa-3831"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
          },
          {
            "name": "1038320",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038320"
          },
          {
            "name": "RHSA-2017:1104",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1104"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1344467"
          },
          {
            "name": "RHSA-2017:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1201"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "52.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "45.9",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "52.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "53",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2017-04-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability while parsing \"application/http-index-format\" format content where uninitialized values are used to create an array. This could allow the reading of uninitialized memory into the arrays affected. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Uninitialized values used while parsing application/http-index-format content",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-12T09:57:01.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "RHSA-2017:1106",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1106"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
        },
        {
          "name": "97940",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97940"
        },
        {
          "name": "DSA-3831",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2017/dsa-3831"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
        },
        {
          "name": "1038320",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038320"
        },
        {
          "name": "RHSA-2017:1104",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1104"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1344467"
        },
        {
          "name": "RHSA-2017:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1201"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2017-5445",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Thunderbird",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "52.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "45.9"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "52.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "53"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability while parsing \"application/http-index-format\" format content where uninitialized values are used to create an array. This could allow the reading of uninitialized memory into the arrays affected. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Uninitialized values used while parsing application/http-index-format content"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2017:1106",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1106"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-12/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-11/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-10/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
            },
            {
              "name": "97940",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97940"
            },
            {
              "name": "DSA-3831",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2017/dsa-3831"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-13/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
            },
            {
              "name": "1038320",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038320"
            },
            {
              "name": "RHSA-2017:1104",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1104"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1344467",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1344467"
            },
            {
              "name": "RHSA-2017:1201",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1201"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2017-5445",
    "datePublished": "2018-06-11T21:00:00.000Z",
    "dateReserved": "2017-01-13T00:00:00.000Z",
    "dateUpdated": "2024-08-05T15:04:13.330Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-5446 (GCVE-0-2017-5446)

Vulnerability from cvelistv5 – Published: 2018-06-11 21:00 – Updated: 2024-08-05 15:04

Summary

An out-of-bounds read when an HTTP/2 connection to a servers sends "DATA" frames with incorrect data content. This leads to a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Severity

No CVSS data available.

CWE

Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data

Assigner

mozilla mitre root

References

11 references

URL	Tags
https://access.redhat.com/errata/RHSA-2017:1106	vendor-advisoryx_refsource_REDHAT
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
https://bugzilla.mozilla.org/show_bug.cgi?id=1343505	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/97940	vdb-entryx_refsource_BID
https://www.debian.org/security/2017/dsa-3831	vendor-advisoryx_refsource_DEBIAN
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
http://www.securitytracker.com/id/1038320	vdb-entryx_refsource_SECTRACK
https://access.redhat.com/errata/RHSA-2017:1104	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:1201	vendor-advisoryx_refsource_REDHAT

Impacted products

3 products

Vendor	Product	Version
Mozilla	Thunderbird	Affected: unspecified , < 52.1 (custom)
Mozilla	Firefox ESR	Affected: unspecified , < 45.9 (custom) Affected: unspecified , < 52.1 (custom)
Mozilla	Firefox	Affected: unspecified , < 53 (custom)

Date Public

2017-04-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:04:14.345Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2017:1106",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1106"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1343505"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
          },
          {
            "name": "97940",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97940"
          },
          {
            "name": "DSA-3831",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2017/dsa-3831"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
          },
          {
            "name": "1038320",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038320"
          },
          {
            "name": "RHSA-2017:1104",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1104"
          },
          {
            "name": "RHSA-2017:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1201"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "52.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "45.9",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "52.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "53",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2017-04-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An out-of-bounds read when an HTTP/2 connection to a servers sends \"DATA\" frames with incorrect data content. This leads to a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-12T09:57:01.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "RHSA-2017:1106",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1106"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1343505"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
        },
        {
          "name": "97940",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97940"
        },
        {
          "name": "DSA-3831",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2017/dsa-3831"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
        },
        {
          "name": "1038320",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038320"
        },
        {
          "name": "RHSA-2017:1104",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1104"
        },
        {
          "name": "RHSA-2017:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1201"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2017-5446",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Thunderbird",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "52.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "45.9"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "52.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "53"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An out-of-bounds read when an HTTP/2 connection to a servers sends \"DATA\" frames with incorrect data content. This leads to a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Out-of-bounds read when HTTP/2 DATA frames are sent with incorrect data"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2017:1106",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1106"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-12/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1343505",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1343505"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-11/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-10/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
            },
            {
              "name": "97940",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97940"
            },
            {
              "name": "DSA-3831",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2017/dsa-3831"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-13/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
            },
            {
              "name": "1038320",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038320"
            },
            {
              "name": "RHSA-2017:1104",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1104"
            },
            {
              "name": "RHSA-2017:1201",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1201"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2017-5446",
    "datePublished": "2018-06-11T21:00:00.000Z",
    "dateReserved": "2017-01-13T00:00:00.000Z",
    "dateUpdated": "2024-08-05T15:04:14.345Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-5447 (GCVE-0-2017-5447)

Vulnerability from cvelistv5 – Published: 2018-06-11 21:00 – Updated: 2024-08-05 15:04

Summary

An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitable crash and could allow an attacker to read otherwise inaccessible memory. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Severity

No CVSS data available.

CWE

Out-of-bounds read during glyph processing

Assigner

mozilla mitre root

References

12 references

URL	Tags
https://www.exploit-db.com/exploits/42071/	exploitx_refsource_EXPLOIT-DB
https://access.redhat.com/errata/RHSA-2017:1106	vendor-advisoryx_refsource_REDHAT
https://bugzilla.mozilla.org/show_bug.cgi?id=1343552	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/97940	vdb-entryx_refsource_BID
https://www.debian.org/security/2017/dsa-3831	vendor-advisoryx_refsource_DEBIAN
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
http://www.securitytracker.com/id/1038320	vdb-entryx_refsource_SECTRACK
https://access.redhat.com/errata/RHSA-2017:1104	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:1201	vendor-advisoryx_refsource_REDHAT

Impacted products

3 products

Vendor	Product	Version
Mozilla	Thunderbird	Affected: unspecified , < 52.1 (custom)
Mozilla	Firefox ESR	Affected: unspecified , < 45.9 (custom) Affected: unspecified , < 52.1 (custom)
Mozilla	Firefox	Affected: unspecified , < 53 (custom)

Date Public

2017-04-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:04:14.298Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "42071",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/42071/"
          },
          {
            "name": "RHSA-2017:1106",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1106"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1343552"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
          },
          {
            "name": "97940",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97940"
          },
          {
            "name": "DSA-3831",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2017/dsa-3831"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
          },
          {
            "name": "1038320",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038320"
          },
          {
            "name": "RHSA-2017:1104",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1104"
          },
          {
            "name": "RHSA-2017:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1201"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "52.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "45.9",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "52.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "53",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2017-04-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitable crash and could allow an attacker to read otherwise inaccessible memory. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Out-of-bounds read during glyph processing",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-12T09:57:01.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "42071",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/42071/"
        },
        {
          "name": "RHSA-2017:1106",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1106"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1343552"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
        },
        {
          "name": "97940",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97940"
        },
        {
          "name": "DSA-3831",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2017/dsa-3831"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
        },
        {
          "name": "1038320",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038320"
        },
        {
          "name": "RHSA-2017:1104",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1104"
        },
        {
          "name": "RHSA-2017:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1201"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2017-5447",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Thunderbird",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "52.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "45.9"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "52.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "53"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitable crash and could allow an attacker to read otherwise inaccessible memory. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Out-of-bounds read during glyph processing"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "42071",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/42071/"
            },
            {
              "name": "RHSA-2017:1106",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1106"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1343552",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1343552"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-12/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-11/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-10/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
            },
            {
              "name": "97940",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97940"
            },
            {
              "name": "DSA-3831",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2017/dsa-3831"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-13/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
            },
            {
              "name": "1038320",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038320"
            },
            {
              "name": "RHSA-2017:1104",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1104"
            },
            {
              "name": "RHSA-2017:1201",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1201"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2017-5447",
    "datePublished": "2018-06-11T21:00:00.000Z",
    "dateReserved": "2017-01-13T00:00:00.000Z",
    "dateUpdated": "2024-08-05T15:04:14.298Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-5448 (GCVE-0-2017-5448)

Vulnerability from cvelistv5 – Published: 2018-06-11 21:00 – Updated: 2024-08-05 15:04

Summary

An out-of-bounds write in "ClearKeyDecryptor" while decrypting some Clearkey-encrypted media content. The "ClearKeyDecryptor" code runs within the Gecko Media Plugin (GMP) sandbox. If a second mechanism is found to escape the sandbox, this vulnerability allows for the writing of arbitrary data within memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Severity

No CVSS data available.

CWE

Out-of-bounds write in ClearKeyDecryptor

Assigner

mozilla mitre root

References

9 references

URL	Tags
https://access.redhat.com/errata/RHSA-2017:1106	vendor-advisoryx_refsource_REDHAT
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/97940	vdb-entryx_refsource_BID
https://www.debian.org/security/2017/dsa-3831	vendor-advisoryx_refsource_DEBIAN
http://www.securitytracker.com/id/1038320	vdb-entryx_refsource_SECTRACK
https://access.redhat.com/errata/RHSA-2017:1104	vendor-advisoryx_refsource_REDHAT
https://bugzilla.mozilla.org/show_bug.cgi?id=1346648	x_refsource_CONFIRM

Impacted products

2 products

Vendor	Product	Version
Mozilla	Firefox ESR	Affected: unspecified , < 45.9 (custom) Affected: unspecified , < 52.1 (custom)
Mozilla	Firefox	Affected: unspecified , < 53 (custom)

Date Public

2017-04-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:04:14.312Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2017:1106",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1106"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
          },
          {
            "name": "97940",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97940"
          },
          {
            "name": "DSA-3831",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2017/dsa-3831"
          },
          {
            "name": "1038320",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038320"
          },
          {
            "name": "RHSA-2017:1104",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1104"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1346648"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "45.9",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            },
            {
              "lessThan": "52.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "53",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2017-04-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "An out-of-bounds write in \"ClearKeyDecryptor\" while decrypting some Clearkey-encrypted media content. The \"ClearKeyDecryptor\" code runs within the Gecko Media Plugin (GMP) sandbox. If a second mechanism is found to escape the sandbox, this vulnerability allows for the writing of arbitrary data within memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Out-of-bounds write in ClearKeyDecryptor",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-12T09:57:01.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "RHSA-2017:1106",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1106"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
        },
        {
          "name": "97940",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97940"
        },
        {
          "name": "DSA-3831",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2017/dsa-3831"
        },
        {
          "name": "1038320",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038320"
        },
        {
          "name": "RHSA-2017:1104",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1104"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1346648"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2017-5448",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "45.9"
                          },
                          {
                            "version_affected": "\u003c",
                            "version_value": "52.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "53"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An out-of-bounds write in \"ClearKeyDecryptor\" while decrypting some Clearkey-encrypted media content. The \"ClearKeyDecryptor\" code runs within the Gecko Media Plugin (GMP) sandbox. If a second mechanism is found to escape the sandbox, this vulnerability allows for the writing of arbitrary data within memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR \u003c 45.9, Firefox ESR \u003c 52.1, and Firefox \u003c 53."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Out-of-bounds write in ClearKeyDecryptor"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2017:1106",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1106"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-12/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-11/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-11/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-10/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
            },
            {
              "name": "97940",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97940"
            },
            {
              "name": "DSA-3831",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2017/dsa-3831"
            },
            {
              "name": "1038320",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038320"
            },
            {
              "name": "RHSA-2017:1104",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1104"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1346648",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1346648"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2017-5448",
    "datePublished": "2018-06-11T21:00:00.000Z",
    "dateReserved": "2017-01-13T00:00:00.000Z",
    "dateUpdated": "2024-08-05T15:04:14.312Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-5449 (GCVE-0-2017-5449)

Vulnerability from cvelistv5 – Published: 2018-06-11 21:00 – Updated: 2024-08-05 15:04

Summary

A possibly exploitable crash triggered during layout and manipulation of bidirectional unicode text in concert with CSS animations. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.

Severity

No CVSS data available.

CWE

Crash during bidirectional unicode manipulation with animation

Assigner

mozilla mitre root

References

9 references

URL	Tags
https://access.redhat.com/errata/RHSA-2017:1106	vendor-advisoryx_refsource_REDHAT
https://bugzilla.mozilla.org/show_bug.cgi?id=1340127	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
http://www.securityfocus.com/bid/97940	vdb-entryx_refsource_BID
https://www.mozilla.org/security/advisories/mfsa2…	x_refsource_CONFIRM
http://www.securitytracker.com/id/1038320	vdb-entryx_refsource_SECTRACK
https://access.redhat.com/errata/RHSA-2017:1104	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2017:1201	vendor-advisoryx_refsource_REDHAT

Impacted products

3 products

Vendor	Product	Version
Mozilla	Thunderbird	Affected: unspecified , < 52.1 (custom)
Mozilla	Firefox ESR	Affected: unspecified , < 52.1 (custom)
Mozilla	Firefox	Affected: unspecified , < 53 (custom)

Date Public

2017-04-19 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:04:14.706Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2017:1106",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1106"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1340127"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
          },
          {
            "name": "97940",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97940"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
          },
          {
            "name": "1038320",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1038320"
          },
          {
            "name": "RHSA-2017:1104",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1104"
          },
          {
            "name": "RHSA-2017:1201",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2017:1201"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "52.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "52.1",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "lessThan": "53",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2017-04-19T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A possibly exploitable crash triggered during layout and manipulation of bidirectional unicode text in concert with CSS animations. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 52.1, and Firefox \u003c 53."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Crash during bidirectional unicode manipulation with animation",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-12T09:57:01.000Z",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "name": "RHSA-2017:1106",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1106"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1340127"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
        },
        {
          "name": "97940",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97940"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
        },
        {
          "name": "1038320",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1038320"
        },
        {
          "name": "RHSA-2017:1104",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1104"
        },
        {
          "name": "RHSA-2017:1201",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2017:1201"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2017-5449",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Thunderbird",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "52.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "52.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "53"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A possibly exploitable crash triggered during layout and manipulation of bidirectional unicode text in concert with CSS animations. This vulnerability affects Thunderbird \u003c 52.1, Firefox ESR \u003c 52.1, and Firefox \u003c 53."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Crash during bidirectional unicode manipulation with animation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "RHSA-2017:1106",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1106"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1340127",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1340127"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-12/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-12/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-10/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-10/"
            },
            {
              "name": "97940",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97940"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2017-13/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2017-13/"
            },
            {
              "name": "1038320",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1038320"
            },
            {
              "name": "RHSA-2017:1104",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1104"
            },
            {
              "name": "RHSA-2017:1201",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2017:1201"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2017-5449",
    "datePublished": "2018-06-11T21:00:00.000Z",
    "dateReserved": "2017-01-13T00:00:00.000Z",
    "dateUpdated": "2024-08-05T15:04:14.706Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

SUSE-SU-2017:1669-1

CVE-2017-5440 (GCVE-0-2017-5440)

CVE-2017-5441 (GCVE-0-2017-5441)

CVE-2017-5442 (GCVE-0-2017-5442)

CVE-2017-5443 (GCVE-0-2017-5443)

CVE-2017-5444 (GCVE-0-2017-5444)

CVE-2017-5445 (GCVE-0-2017-5445)

CVE-2017-5446 (GCVE-0-2017-5446)

CVE-2017-5447 (GCVE-0-2017-5447)

CVE-2017-5448 (GCVE-0-2017-5448)

CVE-2017-5449 (GCVE-0-2017-5449)

Tags

Sightings

Nomenclature