CVE-2017-5378

EUVD-2017-14482
Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address can be discovered through hash codes, and also allows for data leakage of an object's content using these hash codes. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 82%
Affected Products (NVD)
VendorProductVersion
debiandebian_linux
8.0
redhatenterprise_linux
5.0
redhatenterprise_linux
6.0
redhatenterprise_linux
7.0
redhatenterprise_linux_desktop
5.0
redhatenterprise_linux_desktop
6.0
redhatenterprise_linux_desktop
7.0
redhatenterprise_linux_server
5.0
redhatenterprise_linux_server
6.0
redhatenterprise_linux_server
7.0
redhatenterprise_linux_server_aus
7.3
redhatenterprise_linux_server_aus
7.4
redhatenterprise_linux_server_eus
7.3
redhatenterprise_linux_server_eus
7.4
redhatenterprise_linux_server_eus
7.5
redhatenterprise_linux_workstation
5.0
redhatenterprise_linux_workstation
6.0
redhatenterprise_linux_workstation
7.0
mozillathunderbird
𝑥
< 45.7.0
mozillafirefox
𝑥
< 51.0
mozillafirefox
𝑥
< 45.7.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
firefox
sid
132.0.1-1
fixed
firefox-esr
bookworm
115.14.0esr-1~deb12u1
fixed
bookworm (security)
128.4.0esr-1~deb12u1
fixed
bullseye
115.14.0esr-1~deb11u1
fixed
bullseye (security)
128.4.0esr-1~deb11u1
fixed
sid
128.4.0esr-1
fixed
trixie
128.3.1esr-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
precise
Fixed 51.0.1+build2-0ubuntu0.12.04.1
released
trusty
Fixed 51.0.1+build2-0ubuntu0.14.04.1
released
xenial
Fixed 51.0.1+build2-0ubuntu0.16.04.1
released
yakkety
Fixed 51.0.1+build2-0ubuntu0.16.10.1
released
zesty
Fixed 52.0.1+build2-0ubuntu1
released
thunderbird
precise
Fixed 1:45.7.0+build1-0ubuntu0.12.04.1
released
trusty
Fixed 1:45.7.0+build1-0ubuntu0.14.04.1
released
xenial
Fixed 1:45.7.0+build1-0ubuntu0.16.04.1
released
yakkety
Fixed 1:45.7.0+build1-0ubuntu0.16.10.1
released
zesty
Fixed 1:45.7.0+build1-0ubuntu1
released
Common Weakness Enumeration
References
http://rhn.redhat.com/errata/RHSA-2017-0190.html
http://rhn.redhat.com/errata/RHSA-2017-0238.html
http://www.securityfocus.com/bid/95769
http://www.securitytracker.com/id/1037693
https://bugzilla.mozilla.org/show_bug.cgi?id=1312001
https://bugzilla.mozilla.org/show_bug.cgi?id=1330769
https://security.gentoo.org/glsa/201702-13
https://security.gentoo.org/glsa/201702-22
https://www.debian.org/security/2017/dsa-3771
https://www.debian.org/security/2017/dsa-3832
https://www.mozilla.org/security/advisories/mfsa2017-01/
https://www.mozilla.org/security/advisories/mfsa2017-02/
https://www.mozilla.org/security/advisories/mfsa2017-03/
http://rhn.redhat.com/errata/RHSA-2017-0190.html
http://rhn.redhat.com/errata/RHSA-2017-0238.html
http://www.securityfocus.com/bid/95769
http://www.securitytracker.com/id/1037693
https://bugzilla.mozilla.org/show_bug.cgi?id=1312001
https://bugzilla.mozilla.org/show_bug.cgi?id=1330769
https://security.gentoo.org/glsa/201702-13
https://security.gentoo.org/glsa/201702-22
https://www.debian.org/security/2017/dsa-3771
https://www.debian.org/security/2017/dsa-3832
https://www.mozilla.org/security/advisories/mfsa2017-01/
https://www.mozilla.org/security/advisories/mfsa2017-02/
https://www.mozilla.org/security/advisories/mfsa2017-03/