Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2017-7778: Firefox/Thunderbird risk of crashes or code execution via Graphite2
CVE-2017-7778 · published 8 years ago
Summary
Older versions of Firefox (before 54) and Thunderbird (before 52.2) use the Graphite2 text‑shaping library that contains several memory handling errors. These errors could cause the applications to crash or allow an attacker to run code on the system. Update Firefox, Thunderbird, and any Linux packages that include Graphite2 to the latest versions to eliminate the risk.
What to do
- Update mozilla thunderbird to version 52.2.0 or later.
- Update sil graphite2 to version 1.3.10 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mozilla | firefox |
< 52.2.0 < 54.0 cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:* |
| mozilla | thunderbird |
< 52.2.0 cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:* |
| debian | debian_linux |
8.0 9.0 cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* |
| sil | graphite2 |
< 1.3.10 cpe:2.3:a:sil:graphite2:*:*:*:*:*:*:*:* |
Original advisory text
A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use of uninitialized memory. These issues were addressed in G...
A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2 version 1.3.10. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
References
- http://www.securityfocus.com/bid/99057 Third Party Advisory VDB Entry
- http://www.securitytracker.com/id/1038689 Third Party Advisory VDB Entry
- https://access.redhat.com/errata/RHSA-2017:1440 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1561 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1793 Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1349310 Issue Tracking Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1350047 Issue Tracking Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1352745 Issue Tracking Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1352747 Issue Tracking Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1355174 Issue Tracking Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1355182 Issue Tracking Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1356607 Issue Tracking Vendor Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1358551 Issue Tracking Vendor Advisory
- https://security.gentoo.org/glsa/201710-13 Third Party Advisory
- https://www.debian.org/security/2017/dsa-3881 Third Party Advisory
- https://www.debian.org/security/2017/dsa-3894 Third Party Advisory
- https://www.debian.org/security/2017/dsa-3918 Third Party Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-15/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-16/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-17/ Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Type
CWE-119Buffer Overflow
CWE-125Out-of-bounds Read
CWE-787Out-of-bounds Write
Timeline
Published11 Jun 2018
Updated18 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-7778 · NVD
Track software like this
Free during beta