Alpine: multiple firefox-esr packages: security update to 45.7.0-r0

critical Tenable Cloud Security Plugin ID 404412

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- A use-after-free vulnerability in the Media Decoder when working with media files when some events are
fired after the media elements are freed from memory. This vulnerability affects Thunderbird < 45.7,
Firefox ESR < 45.7, and Firefox < 51. (CVE-2017-5396)

- Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence
of memory corruption and we presume that with enough effort that some of these could be exploited to run
arbitrary code. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.
(CVE-2017-5373)

- JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory
corruption attacks. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.
(CVE-2017-5375)

- Use-after-free while manipulating XSL in XSLT documents. This vulnerability affects Thunderbird < 45.7,
Firefox ESR < 45.7, and Firefox < 51. (CVE-2017-5376)

- Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an
object's address can be discovered through hash codes, and also allows for data leakage of an object's
content using these hash codes. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and
Firefox < 51. (CVE-2017-5378)

Plugin Details

Severity: Critical

ID: 404412

Version: Revision 1.29

Type: Local

Family: Alpine Linux Local Security Checks

Published: 10/31/2023

Updated: 2/6/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Critical

Score: 9.5

Percentile: 99.86

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2017-5396

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 1/24/2017

Reference Information

CVE: CVE-2017-5373, CVE-2017-5375, CVE-2017-5376, CVE-2017-5378, CVE-2017-5380, CVE-2017-5383, CVE-2017-5386, CVE-2017-5390, CVE-2017-5396

BID: 95757, 95758, 95762, 95769

Detections

Analytics