Use-after-free error in Firefox ESR - CVE-2017-7752

Vulnerability identifier: #VU7067

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-7752

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to use-after-free error during specific user interactions with the input method editor (IME) in some languages due to how events are handled. A remote attacker can trigger memory corruption and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

Firefox ESR
Mozilla Firefox
Arch Linux
Gentoo Linux
Debian Linux
SUSE Linux
Ubuntu
Opensuse
Mozilla Thunderbird

Update to version 52.2.

Firefox ESR - update to 52.2.0
Mozilla Firefox - update to 54.0
Mozilla Thunderbird - update to 52.2

• https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/

• openSUSE update for Mozilla
• Ubuntu update for Thunderbird
• SUSE Linux update for MozillaFirefox
• Arch Linux update for thunderbird
• Arch Linux update for firefox
• Ubuntu update for Firefox
• Debian update for firefox-esr
• Debian update for icedove
• Gentoo update for Mozilla Firefox
• SUSE Linux update for MozillaFirefox
• Multiple vulnerabilities in Firefox ESR
• Multiple vulnerabilities in Mozilla Thunderbird
• Multiple vulnerabilities in Mozilla Firefox