Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2017-5442: Thunderbird and Firefox may crash when styling pages
CVE-2017-5442 · published 8 years ago
Summary
Older versions of Thunderbird (before 52.1) and Firefox (before 53, including older Extended Support releases) can unexpectedly stop working when a web page changes the style of elements. This crash could be triggered by a malicious page and may allow an attacker to take control of the program. Update the browsers to the latest version or apply the security patches provided by your Linux distribution to protect your systems.
What to do
- Update mozilla thunderbird to version 52.1.0 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| debian | debian_linux |
9.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux |
6.0 7.0 cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_desktop |
6.0 7.0 cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server |
6.0 7.0 cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_aus |
7.3 7.4 cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* |
| redhat | enterprise_linux_server_eus |
7.3 7.4 7.5 cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:*:*:*:*:*:*:* |
| redhat | enterprise_linux_workstation |
6.0 7.0 cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* |
| mozilla | firefox |
< 45.9.0 < 53.0 52.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
| mozilla | thunderbird |
< 52.1.0 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
Original advisory text
A use-after-free vulnerability during changes in style when manipulating DOM elements. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < ...
A use-after-free vulnerability during changes in style when manipulating DOM elements. This results in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.
References
- http://www.securityfocus.com/bid/97940 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1038320 Third Party Advisory VDB Entry
- https://access.redhat.com/errata/RHSA-2017:1104 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1106 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1201 Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1347979 Issue Tracking Patch Vendor Advisory
- https://www.debian.org/security/2017/dsa-3831 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-10/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-11/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-12/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-13/ Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-416Use After Free
Timeline
Published11 Jun 2018
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-5442 · NVD
Track software like this
Free during beta