Buffer overflow in Firefox ESR - CVE-2017-5373

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU33269

Buffer overflow in Firefox ESR - CVE-2017-5373

Published: June 11, 2018 / Updated: August 3, 2020


Vulnerability identifier: #VU33269
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-5373
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.


Affected software

Firefox ESR
Arch Linux
Gentoo Linux
SUSE Linux
Slackware Linux
firefox-esr (Alpine package)

How to mitigate CVE-2017-5373

Install update from vendor's website.

Firefox ESR - update to 45.6.0
firefox-esr (Alpine package) - update to 45.7.0-r0

External References

Related Security Bulletins