Vulnerability Description
JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Enterprise Linux Desktop | 5.0 |
| Redhat | Enterprise Linux Server | 5.0 |
| Redhat | Enterprise Linux Workstation | 5.0 |
| Mozilla | Firefox | < 45.7.0 |
| Mozilla | Thunderbird | < 45.7.0 |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- http://rhn.redhat.com/errata/RHSA-2017-0190.htmlThird Party Advisory
- http://rhn.redhat.com/errata/RHSA-2017-0238.htmlThird Party Advisory
- http://www.securityfocus.com/bid/95757Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1037693Third Party AdvisoryVDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1325200Issue TrackingPermissions Required
- https://security.gentoo.org/glsa/201702-13Third Party Advisory
- https://security.gentoo.org/glsa/201702-22Third Party Advisory
- https://www.debian.org/security/2017/dsa-3771Third Party Advisory
- https://www.debian.org/security/2017/dsa-3832Third Party Advisory
- https://www.exploit-db.com/exploits/42327/ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/44293/ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/44294/ExploitThird Party AdvisoryVDB Entry
- https://www.mozilla.org/security/advisories/mfsa2017-01/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-02/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-03/Vendor Advisory
FAQ
What is CVE-2017-5375?
CVE-2017-5375 is a vulnerability with a CVSS score of 9.8 (CRITICAL). JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < ...
How severe is CVE-2017-5375?
CVE-2017-5375 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2017-5375?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Workstation, Mozilla Firefox, Mozilla Thunderbird.