Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address can be discovered through hash codes, and also allows for data leakage of an object's content using these hash codes. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-firefox-esr | Jun 11, 2018 | Jun 11, 2018 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Jun 11, 2018 | |
| Centos_linux | — | centos-upgrade-firefoxcentos-upgrade-firefox-debuginfocentos-upgrade-thunderbirdcentos-upgrade-thunderbird-debuginfo | Jan 27, 2017 | Jan 24, 2017 |
| Debian | debian-upgrade-firefox-esrdebian-upgrade-icedove | Jan 27, 2017 | Jan 24, 2017 | |
| Freebsd | freebsd-upgrade-package-firefoxfreebsd-upgrade-package-seamonkeyfreebsd-upgrade-package-linux-seamonkeyfreebsd-upgrade-package-firefox-esrfreebsd-upgrade-package-linux-firefoxfreebsd-upgrade-package-libxulfreebsd-upgrade-package-thunderbirdfreebsd-upgrade-package-linux-thunderbird | Jan 25, 2017 | Jan 24, 2017 | |
| Gentoo Linux | gentoo-linux-upgrade-mail-client-thunderbirdgentoo-linux-upgrade-mail-client-thunderbird-bingentoo-linux-upgrade-www-client-firefoxgentoo-linux-upgrade-www-client-firefox-bin | Oct 30, 2017 | Feb 20, 2017 | |
| Mfsa2017 01 | mozilla-firefox-upgrade-51_0 | Jul 12, 2018 | Jun 11, 2018 | |
| Mfsa2017 02 | mozilla-firefox-esr-upgrade-45_7 | Jan 25, 2017 | Jan 24, 2017 | |
| Mozilla Thunderbird | mozilla-thunderbird-upgrade-45_7 | Jan 27, 2017 | Jan 26, 2017 | |
| Oracle Solaris | oracle-solaris-11-3-upgrade-mail-thunderbird-45-7-1-0-175-3-18-0-3-0oracle-solaris-11-3-upgrade-mail-thunderbird-plugin-thunderbird-lightning-45-7-1-0-175-3-18-0-3-0oracle-solaris-11-3-upgrade-web-browser-firefox-45-7-0-0-175-3-17-0-4-0oracle-solaris-11-3-upgrade-web-browser-firefox-plugin-firefox-java-45-7-0-0-175-3-17-0-4-0oracle-solaris-11-3-upgrade-web-data-firefox-bookmarks-45-7-0-0-175-3-17-0-4-0 | May 29, 2017 | May 29, 2017 | |
| Oracle_linux | — | oracle-linux-upgrade-firefoxoracle-linux-upgrade-thunderbird | Jan 26, 2017 | Jan 24, 2017 |
| Redhat_linux | — | redhat-upgrade-firefoxredhat-upgrade-firefox-debuginforedhat-upgrade-thunderbirdredhat-upgrade-thunderbird-debuginfo | Feb 3, 2017 | Jan 24, 2017 |
| Suse | — | suse-upgrade-mozillafirefoxsuse-upgrade-mozillafirefox-develsuse-upgrade-mozillafirefox-translationssuse-upgrade-mozillafirefox-translations-commonsuse-upgrade-mozillafirefox-translations-othersuse-upgrade-mozillathunderbirdsuse-upgrade-mozillathunderbird-buildsymbolssuse-upgrade-mozillathunderbird-develsuse-upgrade-mozillathunderbird-translations-commonsuse-upgrade-mozillathunderbird-translations-other | Feb 2, 2017 | Jan 24, 2017 |
| Ubuntu | ubuntu-upgrade-firefoxubuntu-upgrade-thunderbird | Jan 28, 2017 | Jan 24, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub