NetSight
IP …
high8.6

CVE-2017-5448

An out-of-bounds write in "ClearKeyDecryptor" while decrypting some Clearkey-encrypted media content.

Impact

An out-of-bounds write in "ClearKeyDecryptor" while decrypting some Clearkey-encrypted media content. The "ClearKeyDecryptor" code runs within the Gecko Media Plugin (GMP) sandbox. If a second mechanism is found to escape the sandbox, this vulnerability allows for the writing of arbitrary data within memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Affected products

VendorProductAffected versions
DebianDebian Linux
Version 7.0
RedhatEnterprise Linux
Versions 6.0, 7.0
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Aus
Versions 7.3, 7.4
RedhatEnterprise Linux Server Eus
Versions 7.3, 7.4, 7.5
RedhatEnterprise Linux Workstation
Versions 6.0, 7.0
MozillaFirefox
before 45.9.0
from 52.0 before 52.1.0
before 53.0

Weakness classification

CWE-787

References