CVE-2017-5456

EUVD-2017-14560
A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read and write access to the local file system. This vulnerability affects Firefox ESR < 52.1 and Firefox < 53.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 56%
Affected Products (NVD)
VendorProductVersion
redhatenterprise_linux
7.0
redhatenterprise_linux_desktop
7.0
redhatenterprise_linux_server
7.0
redhatenterprise_linux_server_aus
7.3
redhatenterprise_linux_server_aus
7.4
redhatenterprise_linux_server_eus
7.3
redhatenterprise_linux_server_eus
7.4
redhatenterprise_linux_server_eus
7.5
redhatenterprise_linux_workstation
7.0
mozillafirefox
𝑥
< 53.0
mozillafirefox
𝑥
< 52.1.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
firefox
sid
132.0.1-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
firefox
precise
ignored
trusty
Fixed 53.0+build6-0ubuntu0.14.04.1
released
xenial
Fixed 53.0+build6-0ubuntu0.16.04.1
released
yakkety
Fixed 53.0+build6-0ubuntu0.16.10.1
released
zesty
Fixed 53.0+build6-0ubuntu0.17.04.1
released
thunderbird
precise
ignored
trusty
dne
xenial
not-affected
yakkety
not-affected
zesty
not-affected
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/97940
http://www.securitytracker.com/id/1038320
https://access.redhat.com/errata/RHSA-2017:1106
https://bugzilla.mozilla.org/show_bug.cgi?id=1344415
https://www.mozilla.org/security/advisories/mfsa2017-10/
https://www.mozilla.org/security/advisories/mfsa2017-12/
http://www.securityfocus.com/bid/97940
http://www.securitytracker.com/id/1038320
https://access.redhat.com/errata/RHSA-2017:1106
https://bugzilla.mozilla.org/show_bug.cgi?id=1344415
https://www.mozilla.org/security/advisories/mfsa2017-10/
https://www.mozilla.org/security/advisories/mfsa2017-12/