critical9.8
CVE-2017-5428
An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest.
Impact
An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the "createImageBitmap" API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer. This vulnerability affects Firefox ESR < 52.0.1 and Firefox < 52.0.1.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Enterprise Linux | Version 7.0 |
| Redhat | Enterprise Linux Desktop | Version 7.0 |
| Redhat | Enterprise Linux Server | Version 7.0 |
| Redhat | Enterprise Linux Server Aus | Versions 7.3, 7.4 |
| Redhat | Enterprise Linux Server Eus | Versions 7.3, 7.4, 7.5 |
| Redhat | Enterprise Linux Workstation | Version 7.0 |
| Mozilla | Firefox | before 52.0.1 |
| Mozilla | Firefox Esr | before 52.0.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://rhn.redhat.com/errata/RHSA-2017-0558.html
- http://www.securityfocus.com/bid/96959
- http://www.securitytracker.com/id/1038060
- https://bugzilla.mozilla.org/show_bug.cgi?id=1348168
- https://www.mozilla.org/security/advisories/mfsa2017-08/
- http://rhn.redhat.com/errata/RHSA-2017-0558.html
- http://www.securityfocus.com/bid/96959
- http://www.securitytracker.com/id/1038060
- https://bugzilla.mozilla.org/show_bug.cgi?id=1348168
- https://www.mozilla.org/security/advisories/mfsa2017-08/