PT-2017-17937 · Mozilla+5 · Firefox+6

Published 2017-05-29 · Updated 2019-04-15 · CVE-2017-7776

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 54

Description A heap-based buffer overflow read issue exists in the Graphite2 library. The problem is located in the graphite2::Silf::getClassGlyph() function.

Recommendations For Firefox versions prior to 54, update to version 54 or later to resolve the issue.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2017-1665

ALT-PU-2017-1886

ALT-PU-2018-1854

CESA-2017_1440

CESA-2017_1561

CESA-2017_1793

CVE-2017-7776

DLA-1007-1

DLA-1013-1

DLA-991-1

DSA-3881-1

DSA-3894-1

DSA-3918-1

MGASA-2017-0178

MGASA-2017-0217

OPENSUSE-SU-2017:1579-1

OPENSUSE-SU-2017_1620-1

RHSA-2017:1440

RHSA-2017:1561

RHSA-2017:1793

RHSA-2017_1440

RHSA-2017_1561

RHSA-2017_1793

USN-3315-1

USN-3321-1

USN-3398-1

Affected Products

Alt Linux

Centos

Firefox

Graphite 2

Red Hat

Suse

Ubuntu

References · 615

• 🔥 https://mozilla.org/en-US/security/advisories/mfsa2017-15 · Exploit
• https://bdu.fstec.ru/vul/2018-00165 · Security Note
• https://ubuntu.com/security/CVE-2017-7773 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-00122 · Security Note
• https://bdu.fstec.ru/vul/2021-04143 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5429 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5181 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5103 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5113 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7835 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5122 · Security Note
• https://bdu.fstec.ru/vul/2021-00069 · Security Note
• https://bdu.fstec.ru/vul/2018-00875 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5126 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5175 · Security Note