{"schemaVersion":3,"id":"CVE-2017-7778","aliases":["UBUNTU-CVE-2017-7778","DEBIAN-CVE-2017-7778"],"status":"published","duplicateOf":null,"title":null,"description":"A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2 version 1.3.10. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.","dates":{"published":"2018-06-11T21:00:00.000Z","modified":"2024-08-05T16:12:28.373Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.8,"severity":"critical","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.5,"severity":"high","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false},{"version":"3.0","versionLabel":"v3.0","source":"OSV · Ubuntu","score":9.8,"severity":"critical","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true},{"version":"3.0","versionLabel":"v3.0","source":"OSV · Debian","score":9.8,"severity":"critical","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":10,"impact":9.8,"computed":true}]},"epss":{"probability":0.05047,"percentile":0.92199,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":-0.10299999999999962,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.0515},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04122,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.05047,"percentile":0.92199}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.04122,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0515,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.05047,"percentile":0.92199}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"},{"id":"CWE-125","name":"Out-of-bounds Read","description":"The product reads data past the end, or before the beginning, of the intended buffer.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/125.html"},{"id":"CWE-787","name":"Out-of-bounds Write","description":"The product writes data past the end, or before the beginning, of the intended buffer.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/787.html"}],"affected":[{"vendor":"debian","product":"firefox-esr","name":"firefox-esr","label":"firefox-esr","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/firefox-esr","purlType":"deb","versions":[{"text":"< 52.2.0esr-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 52.2.0esr-1","eol":null,"hubHref":null},{"vendor":"debian","product":"graphite2","name":"graphite2","label":"graphite2","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/graphite2","purlType":"deb","versions":[{"text":"< 1.3.10-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.10-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"firefox","name":"firefox","label":"firefox","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/firefox","purlType":"deb","versions":[{"text":"< 54.0+build3-0ubuntu0.14.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 54.0+build3-0ubuntu0.16.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 54.0+build3-0ubuntu0.14.04.1 | < 54.0+build3-0ubuntu0.16.04.1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"graphite2","name":"graphite2","label":"graphite2","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/graphite2","purlType":"deb","versions":[{"text":"< 1.3.10-0ubuntu0.14.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 1.3.10-0ubuntu0.16.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.10-0ubuntu0.14.04.1 | < 1.3.10-0ubuntu0.16.04.1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"thunderbird","name":"thunderbird","label":"thunderbird","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/thunderbird","purlType":"deb","versions":[{"text":"< 1:52.2.1+build1-0ubuntu0.14.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 1:52.2.1+build1-0ubuntu0.16.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1:52.2.1+build1-0ubuntu0.14.04.1 | < 1:52.2.1+build1-0ubuntu0.16.04.1","eol":null,"hubHref":null},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"8.0","noFixRecorded":false,"fixedIn":null},{"text":"9.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"8.0 | 9.0","eol":{"isEol":true,"eolDate":"2020-06-30T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"8","label":"8 (Jessie)","eolFrom":"2020-06-30T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"8.11"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"mozilla","product":"firefox","name":"Firefox","label":"firefox","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 54","noFixRecorded":false,"fixedIn":null},{"text":"< 52.2.0","noFixRecorded":false,"fixedIn":null},{"text":"< 54.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 54 | < 52.2.0 | < 54.0","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"firefox","label":"Firefox","category":"app"}},"hubHref":"/vendor/mozilla/firefox"},{"vendor":"mozilla","product":"firefox_esr","name":"firefox esr","label":"firefox_esr","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 52.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 52.2","eol":null,"hubHref":"/vendor/mozilla/firefox_esr"},{"vendor":"mozilla","product":"thunderbird","name":"Thunderbird","label":"thunderbird","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 52.2","noFixRecorded":false,"fixedIn":null},{"text":"< 52.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 52.2 | < 52.2.0","eol":null,"hubHref":"/vendor/mozilla/thunderbird"},{"vendor":"sil","product":"graphite2","name":"graphite2","label":"graphite2","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 1.3.10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.10","eol":null,"hubHref":"/vendor/sil/graphite2"}],"affectedCount":10,"eol":{"hasEol":true,"count":1},"references":[{"url":"http://www.securityfocus.com/bid/99057","label":"www.securityfocus.com/bid/99057","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1350047","label":"bugzilla.mozilla.org/show_bug.cgi?id=1350047","hostname":"bugzilla.mozilla.org","tags":["X Refsource CONFIRM","Issue Tracking","Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2017-15/","label":"www.mozilla.org/security/advisories/mfsa2017-15/","hostname":"www.mozilla.org","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1352747","label":"bugzilla.mozilla.org/show_bug.cgi?id=1352747","hostname":"bugzilla.mozilla.org","tags":["X Refsource CONFIRM","Issue Tracking","Vendor Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1793","label":"access.redhat.com/errata/RHSA-2017:1793","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1356607","label":"bugzilla.mozilla.org/show_bug.cgi?id=1356607","hostname":"bugzilla.mozilla.org","tags":["X Refsource CONFIRM","Issue Tracking","Vendor Advisory"]},{"url":"https://www.debian.org/security/2017/dsa-3918","label":"www.debian.org/security/2017/dsa-3918","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"http://www.securitytracker.com/id/1038689","label":"www.securitytracker.com/id/1038689","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Third Party Advisory"]},{"url":"https://www.debian.org/security/2017/dsa-3894","label":"www.debian.org/security/2017/dsa-3894","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1355174","label":"bugzilla.mozilla.org/show_bug.cgi?id=1355174","hostname":"bugzilla.mozilla.org","tags":["X Refsource CONFIRM","Issue Tracking","Vendor Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1349310","label":"bugzilla.mozilla.org/show_bug.cgi?id=1349310","hostname":"bugzilla.mozilla.org","tags":["X Refsource CONFIRM","Issue Tracking","Vendor Advisory"]},{"url":"https://www.debian.org/security/2017/dsa-3881","label":"www.debian.org/security/2017/dsa-3881","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1440","label":"access.redhat.com/errata/RHSA-2017:1440","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1355182","label":"bugzilla.mozilla.org/show_bug.cgi?id=1355182","hostname":"bugzilla.mozilla.org","tags":["X Refsource CONFIRM","Issue Tracking","Vendor Advisory"]},{"url":"https://security.gentoo.org/glsa/201710-13","label":"security.gentoo.org/glsa/201710-13","hostname":"security.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1561","label":"access.redhat.com/errata/RHSA-2017:1561","hostname":"access.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT","Third Party Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2017-17/","label":"www.mozilla.org/security/advisories/mfsa2017-17/","hostname":"www.mozilla.org","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1358551","label":"bugzilla.mozilla.org/show_bug.cgi?id=1358551","hostname":"bugzilla.mozilla.org","tags":["X Refsource CONFIRM","Issue Tracking","Vendor Advisory"]},{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1352745","label":"bugzilla.mozilla.org/show_bug.cgi?id=1352745","hostname":"bugzilla.mozilla.org","tags":["X Refsource CONFIRM","Issue Tracking","Vendor Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2017-16/","label":"www.mozilla.org/security/advisories/mfsa2017-16/","hostname":"www.mozilla.org","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"https://ubuntu.com/security/CVE-2017-7778","label":"ubuntu.com/security/CVE-2017-7778","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/","label":"www.mozilla.org/en-US/security/advisories/mfsa2017-15/","hostname":"www.mozilla.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-3315-1","label":"ubuntu.com/security/notices/USN-3315-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3321-1","label":"ubuntu.com/security/notices/USN-3321-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3398-1","label":"ubuntu.com/security/notices/USN-3398-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7778","label":"www.cve.org/CVERecord?id=CVE-2017-7778","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-7778","label":"security-tracker.debian.org/tracker/CVE-2017-7778","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["DLA-1007-1","DLA-1013-1","DLA-991-1","DSA-3881-1","DSA-3894-1","DSA-3918-1","MGASA-2017-0178","MGASA-2017-0180","MGASA-2017-0217","MGASA-2018-0018","OPENSUSE-SU-2017:1579-1","OPENSUSE-SU-2024:10601-1","RHSA-2017:1440","RHSA-2017:1561","RHSA-2017:1793","SUSE-SU-2017:1669-1","SUSE-SU-2017:2235-1","USN-3315-1","USN-3321-1","USN-3398-1"],"duplicates":[],"related":["OPENSUSE-SU-2017:1579-1","OPENSUSE-SU-2024:10601-1","SUSE-SU-2017:1669-1","SUSE-SU-2017:2235-1","USN-3315-1","USN-3321-1","USN-3398-1"]},"timeline":[{"kind":"published","date":"2018-06-11T21:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-05T16:12:28.373Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T13:16:25.875Z","stale":false,"partial":false}}