CVE-2017-5373 Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploi...
CriticalCVSS 9.8
EPSS 3.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/firefox-esr(Debian:12) | < 45.7.0esr-1 | 45.7.0esr-1 |
| debian/firefox-esr(Debian:13) | < 45.7.0esr-1 | 45.7.0esr-1 |
| debian/firefox-esr(Debian:14) | < 45.7.0esr-1 | 45.7.0esr-1 |
| mozilla Firefox | < 45.7.0 | 45.7.0 |
| mozilla Firefox | < 51.0 | 51.0 |
| mozilla Thunderbird | < 45.7.0 | 45.7.0 |
| debian linux | = 8.0 | No fix listed |
| redhat enterprise linux desktop | = 5.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 5.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux workstation | = 5.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| alpine/firefox-esr(Alpine:v3.5) | < 45.7.0-r0 | 45.7.0-r0 |
| mozilla Thunderbird | < 45.7 | 45.7 |
| mozilla firefox esr | < 45.7 | 45.7 |
| mozilla Firefox | < 51 | 51 |
References
- Debian Security Tracker CVE-2017-5373 vendor-advisory
- RHSA-2017:0190 third-party-advisory vendor-advisory
- RHSA-2017:0238 third-party-advisory vendor-advisory
- 95762 third-party-advisory vdb-entry
- 1037693 third-party-advisory vdb-entry
- bugzilla.mozilla.org issue-tracking
- GLSA-201702-13 third-party-advisory vendor-advisory
- GLSA-201702-22 third-party-advisory vendor-advisory
- DSA-3771 third-party-advisory vendor-advisory
- DSA-3832 third-party-advisory vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- security.alpinelinux.org vendor-advisory