On Windows systems, if non-null-terminated strings are copied into the crash reporter for some specific registry keys, stack memory data can be copied until a null is found. This can potentially contain private data from the local system. Note: This attack only affects Windows operating systems. Other operating systems are not affected. This vulnerability affects Firefox < 55.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade firefox-esrUpgrade linux-seamonkeyUpgrade seamonkeyUpgrade linux-firefoxUpgrade thunderbirdUpgrade linux-thunderbirdUpgrade firefoxUpgrade libxul | Aug 8, 2017 | Aug 8, 2017 |
| Mfsa2017 18 | — | Upgrade to Mozilla Firefox version 55.0Upgrade to the latest version of Mozilla Firefox | Aug 9, 2017 | Aug 8, 2017 |
| Suse | — | Upgrade MozillaFirefoxUpgrade MozillaFirefox-translations-otherUpgrade MozillaFirefox-translations-common | May 20, 2018 | Aug 8, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub