CVE-2017-7826 Memory safety bugs were reported in Firefox 56 and Firefox ESR 52.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploite...
CriticalCVSS 9.8
EPSS 3.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Memory safety bugs were reported in Firefox 56 and Firefox ESR 52.4. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 57, Firefox ESR < 52.5, and Thunderbird < 52.5.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/firefox-esr(Debian:12) | < 52.5.0esr-1 | 52.5.0esr-1 |
| debian/firefox-esr(Debian:13) | < 52.5.0esr-1 | 52.5.0esr-1 |
| debian/firefox-esr(Debian:14) | < 52.5.0esr-1 | 52.5.0esr-1 |
| debian/thunderbird(Debian:12) | < 1:52.5.0-1 | 1:52.5.0-1 |
| debian/thunderbird(Debian:13) | < 1:52.5.0-1 | 1:52.5.0-1 |
| debian/thunderbird(Debian:14) | < 1:52.5.0-1 | 1:52.5.0-1 |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| mozilla Firefox | < 57.0 | 57.0 |
| mozilla Firefox | < 52.5.0 | 52.5.0 |
| mozilla Thunderbird | < 52.5.0 | 52.5.0 |
| mozilla Firefox | < 57 | 57 |
| mozilla firefox esr | < 52.5 | 52.5 |
Show 1 more
| Product | Affected versions | Fixed in |
|---|---|---|
| mozilla Thunderbird | < 52.5 | 52.5 |
References
- Debian Security Tracker CVE-2017-7826 vendor-advisory
- 101832 third-party-advisory vdb-entry
- 1039803 third-party-advisory vdb-entry
- RHSA-2017:3247 third-party-advisory vendor-advisory
- RHSA-2017:3372 third-party-advisory vendor-advisory
- bugzilla.mozilla.org issue-tracking permissions-required third-party-advisory
- [debian-lts-announce] 20171115 [SECURITY] [DLA 1172-1] firefox-esr security update mailing-list third-party-advisory
- [debian-lts-announce] 20171209 [SECURITY] [DLA 1199-1] thunderbird security update mailing-list third-party-advisory
- USN-3688-1 third-party-advisory vendor-advisory
- DSA-4035 third-party-advisory vendor-advisory
- DSA-4061 third-party-advisory vendor-advisory
- DSA-4075 third-party-advisory vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory
- www.mozilla.org vendor-advisory