CVE-2017-7824 A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content. This is due to an incorrect value being passed within the library during checks a...
CriticalCVSS 9.8
EPSS 3.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A buffer overflow occurs when drawing and validating elements with the ANGLE graphics library, used for WebGL content. This is due to an incorrect value being passed within the library during checks and results in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/firefox-esr(Debian:12) | < 52.4.0esr-2 | 52.4.0esr-2 |
| debian/firefox-esr(Debian:13) | < 52.4.0esr-2 | 52.4.0esr-2 |
| debian/firefox-esr(Debian:14) | < 52.4.0esr-2 | 52.4.0esr-2 |
| debian/thunderbird(Debian:12) | < 1:52.4.0-1 | 1:52.4.0-1 |
| debian/thunderbird(Debian:13) | < 1:52.4.0-1 | 1:52.4.0-1 |
| debian/thunderbird(Debian:14) | < 1:52.4.0-1 | 1:52.4.0-1 |
| redhat enterprise linux aus | = 7.4 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux eus | = 7.4 | No fix listed |
| redhat enterprise linux eus | = 7.5 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| mozilla Firefox | < 52.4.0 | 52.4.0 |
| mozilla Firefox | < 56.0 | 56.0 |
| mozilla Thunderbird | < 52.4.0 | 52.4.0 |
| mozilla Firefox | < 56 | 56 |
| mozilla firefox esr | < 52.4 | 52.4 |
| mozilla Thunderbird | < 52.4 | 52.4 |
References
- Debian Security Tracker CVE-2017-7824 vendor-advisory
- 101053 third-party-advisory vdb-entry
- 1039465 third-party-advisory vdb-entry
- RHSA-2017:2831 third-party-advisory vendor-advisory
- RHSA-2017:2885 third-party-advisory vendor-advisory
- bugzilla.mozilla.org issue-tracking
- [debian-lts-announce] 20171101 [SECURITY] [DLA 1153-1] icedove/thunderbird security update mailing-list third-party-advisory
- GLSA-201803-14 third-party-advisory vendor-advisory
- DSA-3987 third-party-advisory vendor-advisory
- DSA-4014 third-party-advisory vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory