PT-2017-3741 · Mozilla+5 · Firefox+6
Holger Fuhrmannek
+1
·
Published
2017-05-29
·
Updated
2024-06-15
·
CVE-2017-7773
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions:
Firefox versions prior to 54
Description:
The issue is related to a heap-based buffer overflow in the Graphite2 library, specifically in the lz4::decompress function. This can lead to a buffer overflow read in the
graphite2::Silf::readGraphite function of the Graphite 2 library used by Mozilla Firefox and Mozilla Firefox ESR. Exploitation of this issue may allow a remote attacker to cause a denial of service or execute arbitrary code.Recommendations:
For Firefox versions prior to 54, update to version 54 or later to resolve the issue. As a temporary workaround, consider disabling the Graphite2 library until a patch is available. Restrict access to the
lz4::decompress function to minimize the risk of exploitation. Avoid using the graphite2::Silf::readGraphite function in affected versions until the issue is resolved.Exploit
Fix
Out of bounds Read
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Centos
Firefox
Graphite 2
Red Hat
Suse
Ubuntu