The vulnerability of Firefox browsers, Firefox ESR, and the Thunderbird email client, related to the use of after-freeing mechanisms, allows a hacker to trigger a service failure.

🗓️ 13 Jan 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 3 Views

Vulnerabilities in Firefox browsers, extended support release, and Thunderbird allow service disruption via memory after free or after release exploits.

Reporter	Title	Published	Views	Family All 141
IBM Security Bulletins	Security Bulletin: Multiple Mozilla Firefox vulnerability issues in IBM Storwize V7000 Unified	18 Jun 201800:35	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Mozilla Firefox vulnerability issues in IBM SONAS.	18 Jun 201800:35	–	ibm
ALT Linux	Security fix for the ALT Linux 10 package firefox-esr version 45.9.0-alt1	20 Apr 201700:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package thunderbird version 52.1.0-alt1	2 May 201700:00	–	altlinux
FreeBSD	mozilla -- multiple vulnerabilities	19 Apr 201700:00	–	freebsd
Tenable Nessus	Mozilla Firefox < 53 Multiple Vulnerabilities	21 Apr 201700:00	–	nessus
Tenable Nessus	Mozilla Firefox ESR < 52.1 Multiple Vulnerabilities	21 Apr 201700:00	–	nessus
Tenable Nessus	CentOS 6 : firefox (CESA-2017:1104)	21 Apr 201700:00	–	nessus
Tenable Nessus	CentOS 7 : firefox (CESA-2017:1106)	21 Apr 201700:00	–	nessus
Tenable Nessus	CentOS 6 / 7 : thunderbird (CESA-2017:1201)	10 May 201700:00	–	nessus

Vulners

Node

mozilla firefoxRange<53

OR

mozilla firefox_esrRange<45.9

OR

mozilla firefox_esrRange46–52.1

OR

mozilla thunderbirdRange<52.1

OR

red_hat red_hat_enterprise_linuxMatch6

OR

red_hat red_hat_enterprise_linuxMatch7

OR

canonical ubuntuMatch17.04

OR

canonical ubuntuMatch16.10

OR

novell opensuse_leapMatch42.2

OR

novell opensuse_leapMatch42.3

OR

novell opensuse_leapMatch42.1

OR

novell opensuse_leapMatch15.0

OR

novell suse_linux_enterprise_serverMatch12-ltss

OR

novell suse_linux_enterprise_server_for_sap_applicationsMatch12-ltss

OR

novell suse_linux_enterprise_server_for_sap_applicationsMatch12

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2017-5460
security-tracker	www.security-tracker.debian.org/tracker/CVE-2017-5460
bugzilla	www.bugzilla.mozilla.org/show_bug.cgi
ubuntu	www.ubuntu.com/security/notices/USN-3260-1
ubuntu	www.ubuntu.com/security/notices/USN-3278-1
mozilla	www.mozilla.org/security/advisories/mfsa2017-10/
mozilla	www.mozilla.org/security/advisories/mfsa2017-11/
mozilla	www.mozilla.org/security/advisories/mfsa2017-12/
mozilla	www.mozilla.org/security/advisories/mfsa2017-13/
debian	www.debian.org/security/2017/dsa-3831

13 Jan 2021 00:00Current

7.8High risk

Vulners AI Score7.8

CVSS 39.8

CVSS 210

EPSS0.03036

firefox browsers extended support release thunderbird email memory after free after release exploits