CVE-2017-5456 A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read and write access to the local file system. Th...
CriticalCVSS 9.8
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read and write access to the local file system. This vulnerability affects Firefox ESR < 52.1 and Firefox < 53.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux | = 7.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.3 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| mozilla Firefox | < 53.0 | 53.0 |
| mozilla Firefox | < 52.1.0 | 52.1.0 |
| mozilla firefox esr | < 52.1 | 52.1 |
| mozilla Firefox | < 53 | 53 |
References
- 97940 third-party-advisory vdb-entry
- 1038320 third-party-advisory vdb-entry
- RHSA-2017:1106 third-party-advisory vendor-advisory
- bugzilla.mozilla.org exploit issue-tracking patch vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory