logo
DATABASE RESOURCES PRICING ABOUT US

[ASA-201703-15] firefox: arbitrary code execution

Description

Arch Linux Security Advisory ASA-201703-15 ========================================== Severity: High Date : 2017-03-18 CVE-ID : CVE-2017-5428 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-219 Summary ======= The package firefox before version 52.0.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 52.0.1-1. # pacman -Syu "firefox>=52.0.1-1" The problem has been fixed upstream in version 52.0.1. Workaround ========== None. Description =========== An integer overflow in createImageBitmap() was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the createImageBitmap API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer. Impact ====== A remote attacker might be able to execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2017-08/#CVE-2017-5428 https://bugzilla.mozilla.org/show_bug.cgi?id=1348168 https://security.archlinux.org/CVE-2017-5428


Affected Package


OS OS Version Package Name Package Version
ArchLinux any firefox 52.0.1-1

Related