PT-2017-16510 · Mozilla+5 · Firefox+5

Ivan Fratric

·

Publicado

2017-04-19

·

Atualizado

2024-12-12

·

CVE-2017-5448

CVSS v3.1

8.6

Alta

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 45.9 Firefox ESR versions prior to 52.1 Firefox versions prior to 53
Description The issue is related to an out-of-bounds write in the ClearKeyDecryptor while decrypting certain Clearkey-encrypted media content. This code runs within the Gecko Media Plugin (GMP) sandbox. If another mechanism to escape the sandbox is found, this could allow for writing arbitrary data within memory, potentially resulting in a crash that could be exploited.
Recommendations For Firefox ESR versions prior to 45.9, update to version 45.9 or later. For Firefox ESR versions prior to 52.1, update to version 52.1 or later. For Firefox versions prior to 53, update to version 53 or later.

Correção

Memory Corruption

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

ALT-PU-2017-1505
ALT-PU-2017-1506
ALT-PU-2017-1577
ALT-PU-2018-1854
CESA-2017_1104
CESA-2017_1106
CVE-2017-5448
DLA-906-1
DSA-3831-1
MGASA-2017-0118
MGASA-2018-0018
OPENSUSE-SU-2017_1099-1
OPENSUSE-SU-2024:10600-1
OPENSUSE-SU-2024:14572-1
RHSA-2017:1104
RHSA-2017:1106
RHSA-2017_1104
RHSA-2017_1106
SUSE-SU-2017:1175-1
SUSE-SU-2017:1248-1
SUSE-SU-2017:1669-1
SUSE-SU-2017:2235-1
USN-3260-1
USN-3260-2
ZDI-17-320

Produtos afetados

Alt Linux
Centos
Firefox
Red Hat
Suse
Ubuntu