CVE-2017-5448 Memory corruption in Firefox
Out-of-bounds write in Firefox's ClearKeyDecryptor allows arbitrary memory writes, potentially leading to code execution if combined with a sandbox escape.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-5448?
CVE-2017-5448 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 11 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An out-of-bounds write in "ClearKeyDecryptor" while decrypting some Clearkey-encrypted media content. The "ClearKeyDecryptor" code runs within the Gecko Media Plugin (GMP) sandbox. If a second mechanism is found to escape the sandbox, this vulnerability allows for the writing of arbitrary data within memory, resulting in a potentially exploitable crash. This vulnerability affects Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.
Weakness: CWE-787
Which versions are affected by CVE-2017-5448?
It affects 8 products.
Products include Debian Debian Linux, Mozilla Firefox, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus and 2 more.
How do I fix CVE-2017-5448?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-5448 being exploited?
There is no known exploitation of CVE-2017-5448 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2017-5448, GHSA-v22c-c5cc-5mv4, UBUNTU-CVE-2017-5448.