CVE-2017-5447: debian debian_linux Use After Free

CVSS: 9.1v3.0CriticalModified

AliasesUBUNTU-CVE-2017-5447DEBIAN-CVE-2017-5447

Published 11-06-2018Last modified 05-08-2024

Vulnerability summary

CVE-2017-5447 is a critical (CVSS 9.1) Use After Free vulnerability in debian debian_linux. EPSS estimates a 16.98% chance of exploitation in the next 30 days, higher than 97% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.1/10

010

Critical · v3.0 (NVD)

EPSS score

16.98%

0%100%

Medium · -0.33 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2reference, exploit-database

Advisory lineage

Upstream 0 · Downstream 18 · Related 10

DLA-906-1 DSA-3831-1 MGASA-2017-0118 MGASA-2017-0139 MGASA-2018-0018 OPENSUSE-SU-2017:1268-1+12 more

Timeline

11-06-2018
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitable crash and could allow an attacker to read otherwise inaccessible memory. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.09.1v2.06.4

EPSS trend

Probability

16.98%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

-0.33 pp

From 17.31% on 18-09-2026

18-09-202618-10-2026

EPSS score

16.98%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (bugzilla.mozilla.org)
Maturity: unknown
exploit-databasedosmultipleVerified
Mozilla Firefox < 53 - 'gfxTextRun' Out-of-Bounds Read
Maturity: poc

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Redhat6 products

enterprise_linuxEOL6.0 | 7.0
enterprise_linux_desktop6.0 | 7.0
enterprise_linux_server6.0 | 7.0
enterprise_linux_server_aus7.3 | 7.4
enterprise_linux_server_eus7.3 | 7.4 | 7.5

Show all 6

Mozilla3 products

firefox≥ unspecified, < 53 | < 45.9.0 | < 53.0 | 52.0
firefox_esr≥ unspecified, < 45.9 | ≥ unspecified, < 52.1
thunderbird≥ unspecified, < 52.1 | < 52.1.0

Debian2 products

firefox-esr< 45.9.0esr-1
debian_linuxEOL9.0

Ubuntu2 products

firefox< 53.0+build6-0ubuntu0.14.04.1 | < 53.0+build6-0ubuntu0.16.04.1
thunderbird< 1:52.1.1+build1-0ubuntu0.14.04.1 | < 1:52.1.1+build1-0ubuntu0.16.04.1

4 vendors · 13 products

References

18 links

www.exploit-db.com/exploits/42071/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
access.redhat.com/errata/RHSA-2017:1106Vendor AdvisoryX Refsource REDHATThird Party Advisory
bugzilla.mozilla.org/show_bug.cgi?id=1343552X Refsource CONFIRMExploitIssue TrackingVendor Advisory
www.mozilla.org/security/advisories/mfsa2017-12/X Refsource CONFIRMVendor Advisory
www.mozilla.org/security/advisories/mfsa2017-11/X Refsource CONFIRMVendor Advisory
www.mozilla.org/security/advisories/mfsa2017-10/X Refsource CONFIRMVendor Advisory
www.securityfocus.com/bid/97940VDB EntryX Refsource BIDThird Party Advisory
www.debian.org/security/2017/dsa-3831Vendor AdvisoryX Refsource DEBIANThird Party Advisory
www.mozilla.org/security/advisories/mfsa2017-13/X Refsource CONFIRMVendor Advisory
www.securitytracker.com/id/1038320VDB EntryX Refsource SECTRACKThird Party Advisory

Show all 18 references

access.redhat.com/errata/RHSA-2017:1104Vendor AdvisoryX Refsource REDHATThird Party Advisory
access.redhat.com/errata/RHSA-2017:1201Vendor AdvisoryX Refsource REDHATThird Party Advisory
ubuntu.com/security/CVE-2017-5447REPORT
www.mozilla.org/en-US/security/advisories/mfsa2017-10/REPORT
ubuntu.com/security/notices/USN-3260-1Advisory
ubuntu.com/security/notices/USN-3278-1Advisory
www.cve.org/CVERecord?id=CVE-2017-5447REPORT
security-tracker.debian.org/tracker/CVE-2017-5447Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities