SB2017012625 - Information disclosure in firefox-esr (Alpine package)
Published: January 26, 2017
Security Bulletin ID
SB2017012625
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Information disclosure (CVE-ID: CVE-2017-5378)
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address can be discovered through hash codes, and also allows for data leakage of an object's content using these hash codes. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.
Remediation
Install update from vendor's website.