PT-2017-4023 · Mozilla+2 · Firefox+2

Abhishek Arya · Published 2017-07-24 · Updated 2024-12-12 · CVE-2017-7813

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:C

Name of the Vulnerable Software and Affected Versions Mozilla Firefox versions prior to 56

Description The issue is related to a JavaScript parser vulnerability in Mozilla Firefox, which involves reading data beyond buffer boundaries in memory. This can potentially allow a remote attacker to gain unauthorized access to protected information or cause a denial of service. The vulnerability usually results in a non-exploitable crash but can leak a limited amount of information from memory if it matches JavaScript identifier syntax.

Recommendations For versions prior to 56, update to version 56 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information until the update is applied.

Exploit

Fix

Out of bounds Read

Incorrect Type Conversion or Cast

Weakness Enumeration

CWE-125

CWE-704

Related Identifiers

ALT-PU-2017-2437

ALT-PU-2018-1854

BDU:2021-00182

CVE-2017-7813

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

USN-3435-1

USN-3435-2

Affected Products

Alt Linux

Firefox

Ubuntu

References · 1896

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1383951 · Exploit
• https://mozilla.org/en-US/security/advisories/mfsa2017-21 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7814 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7818 · Vendor Advisory
• https://mozilla.org/security/advisories/mfsa2017-21 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7793 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7822 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7815 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-7813 · Vendor Advisory
• https://wiki.astralinux.ru/pages/viewpage.action?pageId=1212483 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7813 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7816 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7820 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3435-2 · Vendor Advisory