Heap-buffer-overflow write in Graphite - CVE-2017-7772

Vulnerability identifier: #VU7083

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-7772

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists in Graphite 2 library due to heap-buffer-overflow write. A remote attacker can execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

Graphite
Arch Linux
Debian Linux
Amazon Linux AMI
Gentoo Linux
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux EUS Compute Node
Ubuntu
Opensuse
Graphite
Mozilla Firefox
Firefox ESR
Mozilla Thunderbird

Install update from vendor's website.

Graphite - update to 1.3.10
Mozilla Firefox - update to 54.0
Mozilla Thunderbird - update to 52.2
Firefox ESR - update to 52.2.0

• https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/

• Multiple vulnerabilities in Orbitz Graphite
• openSUSE update for Mozilla
• Ubuntu update for Thunderbird
• Ubuntu update for graphite2
• Gentoo update for Graphite
• Arch Linux update for thunderbird
• Arch Linux update for firefox
• Ubuntu update for Firefox
• Debian update for firefox-esr
• Debian update for icedove
• Debian update for graphite2
• Amazon Linux AMI update for graphite2
• Gentoo update for Mozilla Firefox
• Multiple vulnerabilities in Firefox ESR
• Multiple vulnerabilities in Mozilla Thunderbird
• Multiple vulnerabilities in Mozilla Firefox
• Multiple vulnerabilities in SIL Graphite2 Engine
• Red Hat update for graphite2