CVE-2017-7778HIGH
Description
A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2 version 1.3.10. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
References
http://www.securityfocus.com/bid/99057
http://www.securitytracker.com/id/1038689
https://access.redhat.com/errata/RHSA-2017:1440
https://access.redhat.com/errata/RHSA-2017:1561
https://access.redhat.com/errata/RHSA-2017:1793
https://bugzilla.mozilla.org/show_bug.cgi?id=1349310
https://bugzilla.mozilla.org/show_bug.cgi?id=1350047
https://bugzilla.mozilla.org/show_bug.cgi?id=1352745
https://bugzilla.mozilla.org/show_bug.cgi?id=1352747
https://bugzilla.mozilla.org/show_bug.cgi?id=1355174
https://bugzilla.mozilla.org/show_bug.cgi?id=1355182
https://bugzilla.mozilla.org/show_bug.cgi?id=1356607
https://bugzilla.mozilla.org/show_bug.cgi?id=1358551
https://security.gentoo.org/glsa/201710-13
https://www.debian.org/security/2017/dsa-3881
https://www.debian.org/security/2017/dsa-3894
https://www.debian.org/security/2017/dsa-3918
https://www.mozilla.org/security/advisories/mfsa2017-15/
Details
Source: MITRE
Published: 2018-06-11
Updated: 2018-08-13
Type: CWE-119
Risk Information
CVSS v2.0
Base Score: 7.5
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Impact Score: 6.4
Exploitability Score: 10
Severity: HIGH
CVSS v3.0
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Impact Score: 5.9
Exploitability Score: 3.9
Severity: CRITICAL
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
Configuration 2
OR
Configuration 3
OR
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 140954 | EulerOS Virtualization for ARM 64 3.0.6.0 : graphite2 (EulerOS-SA-2020-2006) | Nessus | Huawei Local Security Checks | high |
| 127347 | NewStart CGSL MAIN 4.05 : thunderbird Multiple Vulnerabilities (NS-SA-2019-0110) | Nessus | NewStart CGSL Local Security Checks | critical |
| 127332 | NewStart CGSL MAIN 4.05 : firefox Multiple Vulnerabilities (NS-SA-2019-0103) | Nessus | NewStart CGSL Local Security Checks | high |
| 106884 | GLSA-201802-03 : Mozilla Firefox: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | critical |
| 104580 | Virtuozzo 7 : graphite2 / graphite2-devel (VZLSA-2017-1793) | Nessus | Virtuozzo Local Security Checks | high |
| 103848 | GLSA-201710-13 : Graphite: Multiple vulnerabilities | Nessus | Gentoo Local Security Checks | high |
| 102694 | SUSE SLES11 Security Update : MozillaFirefox, MozillaFirefox-branding-SLED, firefox-gcc5, mozilla-nss (SUSE-SU-2017:2235-1) | Nessus | SuSE Local Security Checks | high |
| 102679 | Ubuntu 14.04 LTS / 16.04 LTS / 17.04 : graphite2 vulnerabilities (USN-3398-1) | Nessus | Ubuntu Local Security Checks | high |
| 102546 | Amazon Linux AMI : graphite2 (ALAS-2017-872) | Nessus | Amazon Linux Local Security Checks | high |
| 102240 | EulerOS 2.0 SP2 : graphite2 (EulerOS-SA-2017-1153) | Nessus | Huawei Local Security Checks | high |
| 102239 | EulerOS 2.0 SP1 : graphite2 (EulerOS-SA-2017-1152) | Nessus | Huawei Local Security Checks | high |
| 101983 | Debian DSA-3918-1 : icedove - security update | Nessus | Debian Local Security Checks | high |
| 101925 | Scientific Linux Security Update : graphite2 on SL7.x x86_64 (20170721) | Nessus | Scientific Linux Local Security Checks | high |
| 101907 | CentOS 7 : graphite2 (CESA-2017:1793) | Nessus | CentOS Local Security Checks | high |
| 101883 | RHEL 7 : graphite2 (RHSA-2017:1793) | Nessus | Red Hat Local Security Checks | high |
| 101878 | Oracle Linux 7 : graphite2 (ELSA-2017-1793) | Nessus | Oracle Linux Local Security Checks | high |
| 101855 | EulerOS 2.0 SP2 : firefox (EulerOS-SA-2017-1127) | Nessus | Huawei Local Security Checks | high |
| 101854 | EulerOS 2.0 SP1 : firefox (EulerOS-SA-2017-1126) | Nessus | Huawei Local Security Checks | high |
| 101772 | Mozilla Thunderbird < 52.2 Multiple Vulnerabilities | Nessus | Windows | high |
| 101771 | Mozilla Thunderbird < 52.2 Multiple Vulnerabilities (macOS) | Nessus | MacOS X Local Security Checks | high |
| 101485 | Virtuozzo 6 : thunderbird (VZLSA-2017-1561) | Nessus | Virtuozzo Local Security Checks | high |
| 101480 | Virtuozzo 7 : firefox (VZLSA-2017-1440) | Nessus | Virtuozzo Local Security Checks | high |
| 101261 | Ubuntu 14.04 LTS / 16.04 LTS / 16.10 / 17.04 : thunderbird vulnerabilities (USN-3321-1) | Nessus | Ubuntu Local Security Checks | high |
| 101238 | Debian DLA-1013-1 : graphite2 security update | Nessus | Debian Local Security Checks | high |
| 101208 | Debian DLA-1007-1 : icedove/thunderbird security update | Nessus | Debian Local Security Checks | high |
| 101055 | SUSE SLED12 / SLES12 Security Update : MozillaFirefox, MozillaFirefox-branding-SLE (SUSE-SU-2017:1669-1) | Nessus | SuSE Local Security Checks | high |
| 101011 | Debian DSA-3894-1 : graphite2 - security update | Nessus | Debian Local Security Checks | high |
| 100984 | Scientific Linux Security Update : thunderbird on SL6.x, SL7.x i386/x86_64 (20170621) | Nessus | Scientific Linux Local Security Checks | high |
| 100978 | Oracle Linux 6 / 7 : thunderbird (ELSA-2017-1561) | Nessus | Oracle Linux Local Security Checks | high |
| 100965 | CentOS 6 / 7 : thunderbird (CESA-2017:1561) | Nessus | CentOS Local Security Checks | high |
| 100950 | RHEL 6 / 7 : thunderbird (RHSA-2017:1561) | Nessus | Red Hat Local Security Checks | high |
| 100885 | openSUSE Security Update : Mozilla based packages (openSUSE-2017-712) | Nessus | SuSE Local Security Checks | high |
| 100851 | Debian DLA-991-1 : firefox-esr security update | Nessus | Debian Local Security Checks | high |
| 100835 | Ubuntu 14.04 LTS / 16.04 LTS / 16.10 / 17.04 : firefox vulnerabilities (USN-3315-1) | Nessus | Ubuntu Local Security Checks | high |
| 100815 | CentOS 6 / 7 : firefox (CESA-2017:1440) | Nessus | CentOS Local Security Checks | high |
| 100810 | Mozilla Firefox < 54 Multiple Vulnerabilities | Nessus | Windows | high |
| 100809 | Mozilla Firefox ESR < 52.2 Multiple Vulnerabilities | Nessus | Windows | high |
| 100808 | Mozilla Firefox < 54 Multiple Vulnerabilities (macOS) | Nessus | MacOS X Local Security Checks | high |
| 100807 | Mozilla Firefox ESR < 52.2 Multiple Vulnerabilities (macOS) | Nessus | MacOS X Local Security Checks | high |
| 100802 | Scientific Linux Security Update : firefox on SL6.x, SL7.x i386/x86_64 (20170614) | Nessus | Scientific Linux Local Security Checks | high |
| 100801 | RHEL 6 / 7 : firefox (RHSA-2017:1440) | Nessus | Red Hat Local Security Checks | high |
| 100800 | Oracle Linux 6 / 7 : firefox (ELSA-2017-1440) | Nessus | Oracle Linux Local Security Checks | high |
| 100797 | Debian DSA-3881-1 : firefox-esr - security update | Nessus | Debian Local Security Checks | high |
| 700134 | Mozilla Firefox < 54 Multiple Vulnerabilities | Nessus Network Monitor | Web Clients | high |
| 100775 | FreeBSD : mozilla -- multiple vulnerabilities (6cec1b0a-da15-467d-8691-1dea392d4c8d) | Nessus | FreeBSD Local Security Checks | high |