CVE-2017-5401: debian debian_linux 7PK - Errors

CVSS: 9.8v3.0CriticalModified

AliasesUBUNTU-CVE-2017-5401DEBIAN-CVE-2017-5401

Published 11-06-2018Last modified 05-08-2024

Vulnerability summary

CVE-2017-5401 is a critical (CVSS 9.8) 7PK - Errors vulnerability in debian debian_linux. EPSS estimates a 2.96% chance of exploitation in the next 30 days, higher than 87% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.0 (NVD)

EPSS score

2.96%

0%100%

Low · -0.06 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 20 · Related 10

Timeline

11-06-2018
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error. The resulting crash may be exploitable. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.09.8v2.07.5

EPSS trend

Probability

2.96%

Chance of exploitation in the next 30 days

Percentile

87%

Versus all other CVEs

30-day change

-0.06 pp

From 3.02% on 19-09-2026

19-09-202619-10-2026

EPSS score

2.96%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found

referenceUnverified
Exploit Reference (bugzilla.mozilla.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-3887PK - ErrorsThis category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."

Affected systems

Redhat6 products

enterprise_linuxEOL5.0 | 6.0 | 7.0
enterprise_linux_desktop5.0 | 6.0 | 7.0
enterprise_linux_server5.0 | 6.0 | 7.0
enterprise_linux_server_aus7.3 | 7.4
enterprise_linux_server_eus7.3 | 7.4 | 7.5

Show all 6

Mozilla3 products

firefox≥ unspecified, < 52 | < 52.0 | < 45.8.0
firefox_esr≥ unspecified, < 45.8
thunderbird≥ unspecified, < 52 | ≥ unspecified, < 45.8 | < 45.8.0

Debian2 products

firefox-esr< 45.8.0esr-1
debian_linuxEOL9.0

Ubuntu2 products

firefox< 52.0+build2-0ubuntu0.14.04.1 | < 52.0+build2-0ubuntu0.16.04.1
thunderbird< 1:45.8.0+build1-0ubuntu0.14.04.1 | < 1:45.8.0+build1-0ubuntu0.16.04.1

4 vendors · 13 products

References

20 links

rhn.redhat.com/errata/RHSA-2017-0459.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
www.securityfocus.com/bid/96677VDB EntryX Refsource BIDThird Party Advisory
www.mozilla.org/security/advisories/mfsa2017-09/X Refsource CONFIRMVendor Advisory
www.debian.org/security/2017/dsa-3832Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.mozilla.org/security/advisories/mfsa2017-07/X Refsource CONFIRMVendor Advisory
www.mozilla.org/security/advisories/mfsa2017-05/X Refsource CONFIRMVendor Advisory
www.securitytracker.com/id/1037966VDB EntryX Refsource SECTRACKThird Party Advisory
bugzilla.mozilla.org/show_bug.cgi?id=1328861X Refsource CONFIRMExploitIssue TrackingVendor Advisory
security.gentoo.org/glsa/201705-06Vendor AdvisoryX Refsource GENTOOThird Party Advisory
rhn.redhat.com/errata/RHSA-2017-0461.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory

Show all 20 references

www.debian.org/security/2017/dsa-3805Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.mozilla.org/security/advisories/mfsa2017-06/X Refsource CONFIRMVendor Advisory
rhn.redhat.com/errata/RHSA-2017-0498.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
security.gentoo.org/glsa/201705-07Vendor AdvisoryX Refsource GENTOOThird Party Advisory
ubuntu.com/security/CVE-2017-5401REPORT
www.mozilla.org/en-US/security/advisories/mfsa2017-05/REPORT
ubuntu.com/security/notices/USN-3216-1Advisory
ubuntu.com/security/notices/USN-3233-1Advisory
www.cve.org/CVERecord?id=CVE-2017-5401REPORT
security-tracker.debian.org/tracker/CVE-2017-5401Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities