Out-of-bounds read in Firefox ESR - CVE-2017-7758

Vulnerability identifier: #VU7072

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-7758

CWE-ID: CWE-125

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to obtain potentially sensitive on the target system.

The weakness exists due to out-of-bounds read with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use. A remote attacker can trigger memory corruption and read arbitrary files on the system.

Successful exploitation of the vulnerability results in information disclosure.

Firefox ESR
Mozilla Firefox
Arch Linux
Gentoo Linux
Debian Linux
SUSE Linux
Ubuntu
Opensuse
Mozilla Thunderbird

Update to version 52.2.

Firefox ESR - update to 52.2.0
Mozilla Firefox - update to 54.0
Mozilla Thunderbird - update to 52.2

• https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/

• openSUSE update for Mozilla
• Ubuntu update for Thunderbird
• SUSE Linux update for MozillaFirefox
• Arch Linux update for thunderbird
• Arch Linux update for firefox
• Ubuntu update for Firefox
• Debian update for firefox-esr
• Debian update for icedove
• Gentoo update for Mozilla Firefox
• SUSE Linux update for MozillaFirefox
• Multiple vulnerabilities in Firefox ESR
• Multiple vulnerabilities in Mozilla Thunderbird
• Multiple vulnerabilities in Mozilla Firefox