PT-2017-16506 · Linux+4 · Linux+5

Jed Davis · Published 2017-03-07 · Updated 2024-12-12 · CVE-2017-5426

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 52 Thunderbird versions prior to 52

Description The issue occurs on Linux when the seccomp-bpf filter is running and the Gecko Media Plugin sandbox is started, causing the sandbox to fail and leaving items with only the filter's protection, which is typically weaker than the sandbox. This issue is specific to Linux and does not affect other operating systems.

Recommendations For Firefox versions prior to 52, update to version 52 or later to resolve the issue. For Thunderbird versions prior to 52, update to version 52 or later to resolve the issue.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

ALT-PU-2017-1322

ALT-PU-2017-1578

CVE-2017-5426

MGASA-2018-0018

OPENSUSE-SU-2017:1268-1

OPENSUSE-SU-2017_0690-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:10601-1

OPENSUSE-SU-2024:14572-1

USN-3216-1

USN-3216-2

Affected Products

Alt Linux

Firefox

Linux

Suse

Thunderbird

Ubuntu

References · 2006

• https://ubuntu.com/security/CVE-2017-5400 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0018.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2017-05 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3216-2 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3216-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5399 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5422 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5426 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5405 · Vendor Advisory
• https://bugzilla.mozilla.org/show_bug.cgi?id=1257361 · Vendor Advisory
• https://mozilla.org/en-US/security/advisories/mfsa2017-19 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3216-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5415 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-5414 · Vendor Advisory