Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-5469: Firefox and Thunderbird may crash from memory error

CVE-2017-5469 · published 8 years ago

Summary

Certain older versions of Firefox, Firefox Extended Support Release, and Thunderbird can experience a memory handling mistake that could cause the program to stop working unexpectedly. This issue is present in the versions shipped with some Debian and Red Hat Linux installations. Updating to the latest browser and email client releases, or applying the latest security patches from your Linux distribution, will resolve the problem.

What to do

Update mozilla thunderbird to version 52.1.0 or later.

Affected software

Vendor	Product	Affected versions
debian	debian_linux	8.0 `cpe:2.3:o:debian:debian_linux:8.0:::::::*`
redhat	enterprise_linux	6.0 7.0 `cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*`
redhat	enterprise_linux_desktop	6.0 7.0 `cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*`
redhat	enterprise_linux_server	6.0 7.0 `cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*`
redhat	enterprise_linux_server_aus	7.3 7.4 `cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:::::::*`
redhat	enterprise_linux_server_eus	7.3 7.4 7.5 `cpe:2.3:o:redhat:enterprise_linux_server_eus:7.3:::::::*`
redhat	enterprise_linux_workstation	6.0 7.0 `cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*`
mozilla	firefox	< 45.9.0 < 53.0 52.0 `cpe:2.3:a:mozilla:firefox::::::::`
mozilla	thunderbird	< 52.1.0 `cpe:2.3:a:mozilla:thunderbird::::::::`

Original advisory text

Fixed potential buffer overflows in generated Firefox code due to CVE-2016-6354 issue in Flex. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

References

http://www.securityfocus.com/bid/97940 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1038320 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2017:1104 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1106 Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1201 Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1292534 Issue Tracking Patch Vendor Advisory
https://www.debian.org/security/2017/dsa-3831 Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2017-10/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-11/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-12/ Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-13/ Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

5% chance of attack within 30 days

Type

CWE-119Buffer Overflow

Timeline

Published11 Jun 2018

Updated30 Oct 2026

First seen29 Sep 2026

Sources

CVE-2017-5469 · NVD

Track software like this

Free during beta