PT-2017-3740 · Mozilla+5 · Firefox Esr+7

Holger Fuhrmannek

+1

·

Publicado

2017-05-29

·

Atualizado

2019-04-15

·

CVE-2017-7772

CVSS v3.1

8.8

Alta

VetorAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Graphite 2 versions prior to 54 Mozilla Firefox versions prior to 54 Mozilla Firefox ESR versions prior to 54
Description: The issue is caused by a heap-based buffer overflow in the lz4::decompress function of the Graphite 2 library. This can be exploited by a remote attacker to cause a denial of service or execute arbitrary code.
Recommendations: For Graphite 2 versions prior to 54, update to version 54 or later to resolve the issue. For Mozilla Firefox versions prior to 54, update to version 54 or later to resolve the issue. For Mozilla Firefox ESR versions prior to 54, update to version 54 or later to resolve the issue.

Exploit

Correção

Heap Based Buffer Overflow

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-122CWE-119

Identificadores relacionados

ALT-PU-2017-1665
ALT-PU-2017-1886
ALT-PU-2018-1854
BDU:2019-00228
CESA-2017_1440
CESA-2017_1561
CESA-2017_1793
CVE-2017-7772
DLA-1007-1
DLA-1013-1
DLA-991-1
DSA-3881-1
DSA-3894-1
DSA-3918-1
MGASA-2017-0178
MGASA-2017-0217
OPENSUSE-SU-2017:1579-1
OPENSUSE-SU-2017_1620-1
RHSA-2017:1440
RHSA-2017:1561
RHSA-2017:1793
RHSA-2017_1440
RHSA-2017_1561
RHSA-2017_1793
USN-3315-1
USN-3321-1
USN-3398-1

Produtos afetados

Alt Linux
Centos
Graphite 2
Firefox
Firefox Esr
Red Hat
Suse
Ubuntu