Vulnerability Description
During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian | Debian Linux | 8.0 |
| Redhat | Enterprise Linux | 6.0 |
| Redhat | Enterprise Linux Desktop | 6.0 |
| Redhat | Enterprise Linux Server | 6.0 |
| Redhat | Enterprise Linux Server Aus | 7.3 |
| Redhat | Enterprise Linux Server Eus | 7.3 |
| Redhat | Enterprise Linux Workstation | 6.0 |
| Mozilla | Firefox | < 53.0 |
| Mozilla | Thunderbird | < 52.1.0 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/97940Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1038320Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:1104Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1106Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1201Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1347075Issue TrackingVendor Advisory
- https://www.debian.org/security/2017/dsa-3831Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-10/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-11/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-12/Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-13/Vendor Advisory
- http://www.securityfocus.com/bid/97940Third Party AdvisoryVDB Entry
- http://www.securitytracker.com/id/1038320Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:1104Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1106Third Party Advisory
FAQ
What is CVE-2017-5464?
CVE-2017-5464 is a vulnerability with a CVSS score of 9.8 (CRITICAL). During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading to memory corruption and a potentially exploitable crash. Th...
How severe is CVE-2017-5464?
CVE-2017-5464 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2017-5464?
Check the references section above for vendor advisories and patch information. Affected products include: Debian Debian Linux, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus.