Vulnerability Description
The Gecko Media Plugin sandbox allows access to local files that match specific regular expressions. On OS OX, this matching allows access to some data in subdirectories of "/private/var" that could expose personal or temporary data. This has been updated to not allow access to "/private/var" and its subdirectories. Note: this issue only affects OS X. Other operating systems are not affected. This vulnerability affects Firefox < 52 and Thunderbird < 52.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mozilla | Firefox | < 52.0 |
| Apple | Mac Os X | - |
| Mozilla | Thunderbird | < 52.0 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/96692Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1037966Third Party AdvisoryVDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1322716Issue TrackingVendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-05/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-09/Vendor Advisory
- http://www.securityfocus.com/bid/96692Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1037966Third Party AdvisoryVDB Entry
- https://bugzilla.mozilla.org/show_bug.cgi?id=1322716Issue TrackingVendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-05/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-09/Vendor Advisory
FAQ
What is CVE-2017-5425?
CVE-2017-5425 is a vulnerability with a CVSS score of 7.5 (HIGH). The Gecko Media Plugin sandbox allows access to local files that match specific regular expressions. On OS OX, this matching allows access to some data in subdirectories of "/private/var" that could e...
How severe is CVE-2017-5425?
CVE-2017-5425 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-5425?
Check the references section above for vendor advisories and patch information. Affected products include: Mozilla Firefox, Apple Mac Os X, Mozilla Thunderbird.