kritik
CVE-2017-5456
Mozilla: Sandbox escape allowing local file system read access (MFSA 2017-12)
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD, Oracle. Daha düşük diyenler: Red Hat (yüksek), Ubuntu (orta).
Açıklama
A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read and write access to the local file system. This vulnerability affects Firefox ESR < 52.1 and Firefox < 53.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| Oracle Linux 7 | firefox | 52.1.0-2.0.1.el7_3 |
| ubuntu 14.04 | firefox | 53.0+build6-0ubuntu0.14.04.1 |
| ubuntu 16.04 | firefox | 53.0+build6-0ubuntu0.16.04.1 |
| ubuntu 16.10 | firefox | 53.0+build6-0ubuntu0.16.10.1 |
| ubuntu 17.04 | firefox | 53.0+build6-0ubuntu0.17.04.1 |
Referanslar
- http://www.securityfocus.com/bid/97940
- http://www.securitytracker.com/id/1038320
- https://access.redhat.com/errata/RHSA-2017:1106
- https://access.redhat.com/security/cve/CVE-2017-5456
- https://bugzilla.mozilla.org/show_bug.cgi?id=1344415
- https://linux.oracle.com/cve/CVE-2017-5456.html
- https://linux.oracle.com/errata/ELSA-2017-1106.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-5456
14 referansın hepsi
- https://ubuntu.com/security/notices/USN-3260-1
- https://www.cve.org/CVERecord?id=CVE-2017-5456
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5456
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-11/#CVE-2017-5456
- https://www.mozilla.org/security/advisories/mfsa2017-10/
- https://www.mozilla.org/security/advisories/mfsa2017-12/