Description

During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for later messages but in some cases, the handshake transcript can exceed the space available in the current buffer, causing the allocation of a new buffer. This leaves a pointer pointing to the old, freed buffer, resulting in a use-after-free when handshake hashes are then calculated afterwards. This can result in a potentially exploitable crash. This vulnerability affects Firefox < 56, Firefox ESR < 52.4, and Thunderbird < 52.4.

References

• BID-101059
• SECTRACK-1039465
• REDHAT-RHSA-2017:2832
• GENTOO-GLSA-201803-14
• DEBIAN-DSA-3987
• DEBIAN-DSA-3998
• DEBIAN-DSA-4014
• NVD-CVE-2017-7805
• UBUNTU-USN-3431-1
• UBUNTU-USN-3435-1
• UBUNTU-USN-3435-2
• UBUNTU-USN-3436-1

Solution

Related Vulnerabilities

• Oracle Solaris 11: CVE-2017-7823: Vulnerability in Firefox, Thunderbird
• CentOS: (CVE-2017-7814) (Multiple Advisories): thunderbird
• Gentoo Linux: CVE-2017-7805: Mozilla Thunderbird: Multiple vulnerabilities
• Red Hat: CVE-2017-7805: Important: nss security update (RHSA-2017:2832)
• Debian: CVE-2017-7814: thunderbird -- security update
• Huawei EulerOS: CVE-2017-7805: nss security update
• Amazon Linux AMI: CVE-2017-7805: Security patch for nss (ALAS-2017-911)
• MFSA2017-22 Firefox: Security vulnerabilities fixed in Firefox ESR 52.4 (CVE-2017-7805)
• Alpine Linux: CVE-2017-7814: firefox-esr Multiple vulnerabilities
• SUSE: CVE-2017-7814: SUSE Linux Security Advisory
• MFSA2017-22 Firefox: Security vulnerabilities fixed in Firefox ESR 52.4 (CVE-2017-7825)
• MFSA2017-22 Firefox: Security vulnerabilities fixed in Firefox ESR 52.4 (CVE-2017-7823)
• Sun Patch: NSS_NSPR_JSS 3.35 Solaris: NSPR 4.18 / NSS 3.35 / JSS 4.3.2 Mainte
• Red Hat: CVE-2017-7823: Critical: firefox security update (Multiple Advisories)
• Red Hat: CVE-2017-7814: Critical: firefox security update (Multiple Advisories)
• Gentoo Linux: CVE-2017-7814: Mozilla Thunderbird: Multiple vulnerabilities
• Gentoo Linux: CVE-2017-7825: Mozilla Thunderbird: Multiple vulnerabilities
• Oracle Linux: (CVE-2017-7805) ELSA-2017-2832: nss security update
• Ubuntu: (Multiple Advisories) (CVE-2017-7823): Thunderbird vulnerabilities
• FreeBSD: VID-1098A15B-B0F6-42B7-B5C7-8A8646E8BE07 (CVE-2017-7825): mozilla -- multiple vulnerabilities
• CentOS: (CVE-2017-7823) (Multiple Advisories): thunderbird
• MFSA2017-21 Firefox: Security vulnerabilities fixed in Firefox 56 (CVE-2017-7805)
• SUSE: CVE-2017-7823: SUSE Linux Security Advisory
• FreeBSD: VID-1098A15B-B0F6-42B7-B5C7-8A8646E8BE07 (CVE-2017-7814): mozilla -- multiple vulnerabilities
• Sun Patch: NSS_NSPR_JSS 3.35: NSPR 4.18 / NSS 3.35 / JSS 4.3.2
• MFSA2017-23 Thunderbird: Security vulnerabilities fixed in Thunderbird 52.4 (CVE-2017-7805)
• MFSA2017-21 Firefox: Security vulnerabilities fixed in Firefox 56 (CVE-2017-7823)
• Alpine Linux: CVE-2017-7823: firefox-esr Multiple vulnerabilities
• Huawei EulerOS: CVE-2017-7805: nss security update
• Oracle Linux: (CVE-2017-7814) (Multiple Advisories): thunderbird security update
• Sun Patch: NSS_NSPR_JSS 3.30.2_x86: NSPR 4.15 / NSS 3.30.2 / JSS 4.3.2
• Oracle Solaris 11: CVE-2017-7825: Vulnerability in Firefox, Thunderbird
• Oracle Solaris 11: CVE-2017-7814: Vulnerability in Firefox, Thunderbird
• Sun Patch: NSS_NSPR_JSS 3.35: NSPR 4.18 / NSS 3.35 / JSS 4.3.2
• MFSA2017-21 Firefox: Security vulnerabilities fixed in Firefox 56 (CVE-2017-7825)
• MFSA2017-23 Thunderbird: Security vulnerabilities fixed in Thunderbird 52.4 (CVE-2017-7825)
• SUSE: CVE-2017-7805: SUSE Linux Security Advisory
• FreeBSD: VID-1098A15B-B0F6-42B7-B5C7-8A8646E8BE07 (CVE-2017-7823): mozilla -- multiple vulnerabilities
• MFSA2017-23 Thunderbird: Security vulnerabilities fixed in Thunderbird 52.4 (CVE-2017-7814)
• CentOS: (CVE-2017-7805) CESA-2017:2832: nss
• Alpine Linux: CVE-2017-7825: firefox-esr Multiple vulnerabilities
• Ubuntu: (Multiple Advisories) (CVE-2017-7805): Thunderbird vulnerabilities
• Sun Patch: NSS_NSPR_JSS 3.35_x86: NSPR 4.18 / NSS 3.35 / JSS 4.3.2
• Debian: CVE-2017-7823: thunderbird -- security update
• FreeBSD: (Multiple Advisories) (CVE-2017-7805): mozilla -- multiple vulnerabilities
• Sun Patch: NSS_NSPR_JSS 3.35: NSPR 4.18 / NSS 3.35 / JSS 4.3.2
• Ubuntu: (Multiple Advisories) (CVE-2017-7814): Thunderbird vulnerabilities
• SUSE: CVE-2017-7825: SUSE Linux Security Advisory
• Alpine Linux: CVE-2017-7805: firefox-esr Multiple vulnerabilities
• Gentoo Linux: CVE-2017-7823: Mozilla Thunderbird: Multiple vulnerabilities
• Sun Patch: NSS_NSPR_JSS 3.35 Solaris_x86: NSPR 4.18 / NSS 3.35 / JSS 4.3.2 Ma
• MFSA2017-22 Firefox: Security vulnerabilities fixed in Firefox ESR 52.4 (CVE-2017-7814)
• MFSA2017-21 Firefox: Security vulnerabilities fixed in Firefox 56 (CVE-2017-7814)
• Oracle Solaris 11: CVE-2017-7805: Vulnerability in Firefox, Thunderbird
• MFSA2017-23 Thunderbird: Security vulnerabilities fixed in Thunderbird 52.4 (CVE-2017-7823)
• Oracle Linux: (CVE-2017-7823) (Multiple Advisories): thunderbird security update