Vulnerability Details : CVE-2017-7810
Memory safety bugs were reported in Firefox 55 and Firefox ESR 52.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.
Vulnerability category: OverflowMemory Corruption
Exploit prediction scoring system (EPSS) score for CVE-2017-7810
Probability of exploitation activity in the next 30 days: 1.01%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 82 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2017-7810
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2017-7810
-
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-7810
-
https://bugzilla.mozilla.org/buglist.cgi?bug_id=1386787%2C1389974%2C1371657%2C1360334%2C1390550%2C1380824%2C1387918%2C1395598
Bug ListIssue Tracking;Permissions Required;Third Party Advisory
-
https://www.mozilla.org/security/advisories/mfsa2017-23/
Security vulnerabilities fixed in Thunderbird 52.4 — MozillaVendor Advisory
-
http://www.securityfocus.com/bid/101054
Mozilla Firefox CVE-2017-7810 Multiple Unspecified Memory Corruption VulnerabilitiesThird Party Advisory;VDB Entry
-
https://lists.debian.org/debian-lts-announce/2017/11/msg00000.html
[SECURITY] [DLA 1153-1] icedove/thunderbird security updateThird Party Advisory
-
http://www.securitytracker.com/id/1039465
Mozilla Firefox Multiple Bugs Let Remote Users Spoof URLs, Conduct Cross-Site Scripting Attacks, Obtain Potentially Sensitive Information, and Execute Arbitrary Code - SecurityTrackerThird Party Advisory;VDB Entry
-
https://www.mozilla.org/security/advisories/mfsa2017-21/
Security vulnerabilities fixed in Firefox 56 — MozillaVendor Advisory
-
https://access.redhat.com/errata/RHSA-2017:2831
RHSA-2017:2831 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
https://security.gentoo.org/glsa/201803-14
Mozilla Thunderbird: Multiple vulnerabilities (GLSA 201803-14) — Gentoo securityThird Party Advisory
-
https://www.debian.org/security/2017/dsa-4014
Debian -- Security Information -- DSA-4014-1 thunderbirdThird Party Advisory
-
https://www.mozilla.org/security/advisories/mfsa2017-22/
Security vulnerabilities fixed in Firefox ESR 52.4 — MozillaVendor Advisory
-
https://www.debian.org/security/2017/dsa-3987
Debian -- Security Information -- DSA-3987-1 firefox-esrThird Party Advisory
-
https://usn.ubuntu.com/3688-1/
USN-3688-1: Spidermonkey vulnerabilities | Ubuntu security noticesThird Party Advisory
-
https://access.redhat.com/errata/RHSA-2017:2885
RHSA-2017:2885 - Security Advisory - Red Hat Customer PortalThird Party Advisory
Products affected by CVE-2017-7810
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
- cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*