CVE-2017-5429

critical
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

References

http://www.securityfocus.com/bid/97940

http://www.securitytracker.com/id/1038320

https://access.redhat.com/errata/RHSA-2017:1104

https://access.redhat.com/errata/RHSA-2017:1106

https://access.redhat.com/errata/RHSA-2017:1201

https://bugzilla.mozilla.org/buglist.cgi?bug_id=1343261%2C1350844%2C1341096%2C1342823%2C1348894%2C1348941%2C1349340%2C1352926%2C1353088%2C

https://www.debian.org/security/2017/dsa-3831

https://www.mozilla.org/security/advisories/mfsa2017-10/

https://www.mozilla.org/security/advisories/mfsa2017-11/

https://www.mozilla.org/security/advisories/mfsa2017-12/

https://www.mozilla.org/security/advisories/mfsa2017-13/

Details

Source: MITRE

Published: 2018-06-11

Updated: 2018-08-07

Type: CWE-119

Risk Information

CVSS v2

Base Score: 7.5

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Impact Score: 6.4

Exploitability Score: 10

Severity: HIGH

CVSS v3

Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 3.9

Severity: CRITICAL

Tenable Plugins

View all (42 total)

IDNameProductFamilySeverity
127347NewStart CGSL MAIN 4.05 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0110)NessusNewStart CGSL Local Security Checks
critical
127332NewStart CGSL MAIN 4.05 : firefox Multiple Vulnerabilities (NS-SA-2019-0103)NessusNewStart CGSL Local Security Checks
critical
106884GLSA-201802-03 : Mozilla Firefox: Multiple vulnerabilitiesNessusGentoo Local Security Checks
critical
102694SUSE SLES11 Security Update : MozillaFirefox, MozillaFirefox-branding-SLED, firefox-gcc5, mozilla-nss (SUSE-SU-2017:2235-1)NessusSuSE Local Security Checks
critical
101460Virtuozzo 6 : thunderbird (VZLSA-2017-1201)NessusVirtuozzo Local Security Checks
critical
101457Virtuozzo 7 : firefox (VZLSA-2017-1106)NessusVirtuozzo Local Security Checks
critical
101455Virtuozzo 6 : firefox (VZLSA-2017-1104)NessusVirtuozzo Local Security Checks
critical
101055SUSE SLED12 / SLES12 Security Update : MozillaFirefox, MozillaFirefox-branding-SLE (SUSE-SU-2017:1669-1)NessusSuSE Local Security Checks
critical
100688EulerOS 2.0 SP2 : firefox (EulerOS-SA-2017-1093)NessusHuawei Local Security Checks
critical
100687EulerOS 2.0 SP1 : firefox (EulerOS-SA-2017-1092)NessusHuawei Local Security Checks
critical
100249Ubuntu 14.04 LTS / 16.04 LTS / 16.10 / 17.04 : thunderbird vulnerabilities (USN-3278-1)NessusUbuntu Local Security Checks
critical
100153Ubuntu 14.04 LTS / 16.04 LTS / 16.10 / 17.04 : firefox regression (USN-3260-2)NessusUbuntu Local Security Checks
critical
100151SUSE SLED12 / SLES12 Security Update : MozillaFirefox, mozilla-nss, mozilla-nspr, java-1_8_0-openjdk (SUSE-SU-2017:1248-1)NessusSuSE Local Security Checks
critical
100065CentOS 6 / 7 : thunderbird (CESA-2017:1201)NessusCentOS Local Security Checks
critical
100049Scientific Linux Security Update : thunderbird on SL6.x, SL7.x i386/x86_64 (20170508)NessusScientific Linux Local Security Checks
critical
100045Oracle Linux 6 / 7 : thunderbird (ELSA-2017-1201)NessusOracle Linux Local Security Checks
critical
100021RHEL 6 / 7 : thunderbird (RHSA-2017:1201)NessusRed Hat Local Security Checks
critical
100020openSUSE Security Update : MozillaThunderbird (openSUSE-2017-545)NessusSuSE Local Security Checks
critical
99992SUSE SLES11 Security Update : MozillaFirefox, mozilla-nss, mozilla-nspr (SUSE-SU-2017:1175-1)NessusSuSE Local Security Checks
critical
99968Mozilla Thunderbird < 52.1 Multiple VulnerabilitiesNessusWindows
critical
99967Mozilla Thunderbird < 52.1 Multiple Vulnerabilities (macOS)NessusMacOS X Local Security Checks
critical
99649openSUSE Security Update : Mozilla Firefox (openSUSE-2017-509)NessusSuSE Local Security Checks
critical
99632Mozilla Firefox < 53 Multiple VulnerabilitiesNessusWindows
critical
99631Mozilla Firefox ESR 52.x < 52.1 Multiple VulnerabilitiesNessusWindows
critical
99630Mozilla Firefox ESR 45.x < 45.9 Multiple VulnerabilitiesNessusWindows
critical
99629Mozilla Firefox < 53 Multiple Vulnerabilities (macOS)NessusMacOS X Local Security Checks
critical
99628Mozilla Firefox ESR < 52.1 Multiple Vulnerabilities (macOS)NessusMacOS X Local Security Checks
critical
99627Mozilla Firefox ESR 45.x < 45.9 Multiple Vulnerabilities (macOS)NessusMacOS X Local Security Checks
critical
99626Ubuntu 14.04 LTS / 16.04 LTS / 16.10 / 17.04 : firefox vulnerabilities (USN-3260-1)NessusUbuntu Local Security Checks
critical
99619Scientific Linux Security Update : firefox on SL7.x x86_64 (20170420)NessusScientific Linux Local Security Checks
critical
99600Debian DLA-906-1 : firefox-esr security updateNessusDebian Local Security Checks
critical
99576Scientific Linux Security Update : firefox on SL6.x i386/x86_64 (20170420)NessusScientific Linux Local Security Checks
critical
99572RHEL 7 : firefox (RHSA-2017:1106)NessusRed Hat Local Security Checks
critical
99570RHEL 6 : firefox (RHSA-2017:1104)NessusRed Hat Local Security Checks
critical
99565Oracle Linux 7 : firefox (ELSA-2017-1106)NessusOracle Linux Local Security Checks
critical
99563Oracle Linux 6 : firefox (ELSA-2017-1104)NessusOracle Linux Local Security Checks
critical
99539CentOS 7 : firefox (CESA-2017:1106)NessusCentOS Local Security Checks
critical
99537CentOS 6 : firefox (CESA-2017:1104)NessusCentOS Local Security Checks
critical
700066Mozilla Firefox ESR < 52.1 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
700065Mozilla Firefox < 53 Multiple VulnerabilitiesNessus Network MonitorWeb Clients
high
99496FreeBSD : mozilla -- multiple vulnerabilities (5e0a038a-ca30-416d-a2f5-38cbf5e7df33)NessusFreeBSD Local Security Checks
critical
99485Debian DSA-3831-1 : firefox-esr - security updateNessusDebian Local Security Checks
critical