Out-of-bounds read in Firefox ESR - CVE-2017-7754

Vulnerability identifier: #VU7068

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-7754

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to out-of-bounds read in WebGL. A remote attacker can use a specially crafted ImageInfo object during WebGL operations and read arbitrary files.
 
Successful exploitation of the vulnerability results in information disclosure.

Firefox ESR
Mozilla Firefox
Arch Linux
Gentoo Linux
Debian Linux
SUSE Linux
Ubuntu
Opensuse
Mozilla Thunderbird

Update to version 52.2.

Firefox ESR - update to 52.2.0
Mozilla Firefox - update to 54.0
Mozilla Thunderbird - update to 52.2

• https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/

• openSUSE update for Mozilla
• Ubuntu update for Thunderbird
• SUSE Linux update for MozillaFirefox
• Arch Linux update for thunderbird
• Arch Linux update for firefox
• Ubuntu update for Firefox
• Debian update for firefox-esr
• Debian update for icedove
• Gentoo update for Mozilla Firefox
• SUSE Linux update for MozillaFirefox
• Multiple vulnerabilities in Firefox ESR
• Multiple vulnerabilities in Mozilla Thunderbird
• Multiple vulnerabilities in Mozilla Firefox