PT-2017-17935 · Mozilla+5 · Graphite2 Library+6

Holger Fuhrmannek + 1 · Published 2017-05-29 · Updated 2019-04-15 · CVE-2017-7774

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 54

Description The issue is related to an out-of-bounds read in the Graphite2 Library. It occurs in the graphite2::Silf::readGraphite function.

Recommendations For versions prior to 54, update to version 54 or later to resolve the issue.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2017-1665

ALT-PU-2017-1886

ALT-PU-2018-1854

CESA-2017_1440

CESA-2017_1561

CESA-2017_1793

CVE-2017-7774

DLA-1007-1

DLA-1013-1

DLA-991-1

DSA-3881-1

DSA-3894-1

DSA-3918-1

MGASA-2017-0178

MGASA-2017-0217

OPENSUSE-SU-2017:1579-1

OPENSUSE-SU-2017_1620-1

RHSA-2017:1440

RHSA-2017:1561

RHSA-2017:1793

RHSA-2017_1440

RHSA-2017_1561

RHSA-2017_1793

USN-3315-1

USN-3321-1

USN-3398-1

Affected Products

Alt Linux

Centos

Firefox

Graphite2 Library

Red Hat

Suse

Ubuntu

References · 615

• 🔥 https://mozilla.org/en-US/security/advisories/mfsa2017-15 · Exploit
• https://bdu.fstec.ru/vul/2018-00165 · Security Note
• https://ubuntu.com/security/CVE-2017-7773 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00122 · Security Note
• https://bdu.fstec.ru/vul/2021-04143 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5429 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5181 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5103 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5113 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7835 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5122 · Security Note
• https://bdu.fstec.ru/vul/2021-00069 · Security Note
• https://bdu.fstec.ru/vul/2018-00875 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7774 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5126 · Security Note