#VU33269 Buffer overflow in Firefox ESR - CVE-2017-5373

Vulnerability identifier: #VU33269

Vulnerability risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-5373

CWE-ID: CWE-119

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Firefox ESR
Client/Desktop applications / Web browsers

Vendor: Mozilla

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Firefox ESR: 45.6

---

External links
https://rhn.redhat.com/errata/RHSA-2017-0190.html
https://rhn.redhat.com/errata/RHSA-2017-0238.html
https://www.securityfocus.com/bid/95762
https://www.securitytracker.com/id/1037693
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1322315%2C1328834%2C1322420%2C1285833%2C1285960%2C1328251%2C1331058%2C1325938%2C1325877
https://security.gentoo.org/glsa/201702-13
https://security.gentoo.org/glsa/201702-22
https://www.debian.org/security/2017/dsa-3771
https://www.debian.org/security/2017/dsa-3832
https://www.mozilla.org/security/advisories/mfsa2017-01/
https://www.mozilla.org/security/advisories/mfsa2017-02/
https://www.mozilla.org/security/advisories/mfsa2017-03/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.