Use-after-free error in Firefox ESR - CVE-2017-5472

Vulnerability identifier: #VU7063

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-5472

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error with the frameloader during tree reconstruction while regenerating CSS layout. A remote attacker can use a node in the tree that no longer exists, trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

Firefox ESR
Mozilla Firefox
Arch Linux
Gentoo Linux
Debian Linux
SUSE Linux
Ubuntu
Opensuse
Mozilla Thunderbird

Update to version 52.2.

Firefox ESR - update to 52.2.0
Mozilla Firefox - update to 54.0
Mozilla Thunderbird - update to 52.2

• https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/

• openSUSE update for Mozilla
• Ubuntu update for Thunderbird
• SUSE Linux update for MozillaFirefox
• Arch Linux update for thunderbird
• Arch Linux update for firefox
• Ubuntu update for Firefox
• Debian update for firefox-esr
• Debian update for icedove
• Gentoo update for Mozilla Firefox
• SUSE Linux update for MozillaFirefox
• Multiple vulnerabilities in Firefox ESR
• Multiple vulnerabilities in Mozilla Thunderbird
• Multiple vulnerabilities in Mozilla Firefox