CVE-2017-5378: Infoleak
First published: Tue Jan 24 2017(Updated: )
Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address can be discovered through hash codes, and also allows for data leakage of an object's content using these hash codes. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.
Credit: security@mozilla.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mozilla Firefox ESR | <45.7 | 45.7 |
| debian/firefox | 118.0.2-1 | |
| debian/firefox-esr | 91.12.0esr-1~deb10u1 115.3.1esr-1~deb10u1 102.15.0esr-1~deb11u1 115.3.1esr-1~deb11u1 102.15.1esr-1~deb12u1 115.3.0esr-1~deb12u1 115.3.0esr-1 115.4.0esr-1 | |
| Mozilla Thunderbird | <45.7 | 45.7 |
| Mozilla Firefox | <51 | 51 |
| Debian GNU/Linux | =8.0 | |
| Red Hat Enterprise Linux | =5.0 | |
| Red Hat Enterprise Linux | =6.0 | |
| Red Hat Enterprise Linux | =7.0 | |
| redhat enterprise Linux desktop | =5.0 | |
| redhat enterprise Linux desktop | =6.0 | |
| redhat enterprise Linux desktop | =7.0 | |
| redhat enterprise Linux server | =5.0 | |
| redhat enterprise Linux server | =6.0 | |
| redhat enterprise Linux server | =7.0 | |
| redhat enterprise Linux server aus | =7.3 | |
| redhat enterprise Linux server aus | =7.4 | |
| redhat enterprise Linux server eus | =7.3 | |
| redhat enterprise Linux server eus | =7.4 | |
| redhat enterprise Linux server eus | =7.5 | |
| redhat enterprise Linux workstation | =5.0 | |
| redhat enterprise Linux workstation | =6.0 | |
| redhat enterprise Linux workstation | =7.0 | |
| Mozilla Thunderbird | <45.7.0 | |
| Mozilla Firefox | <51.0 | |
| Mozilla Firefox ESR | <45.7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.mozilla.org/show_bug.cgi?id=1312001
- https://bugzilla.mozilla.org/show_bug.cgi?id=1330769
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-01/
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-03/
- http://rhn.redhat.com/errata/RHSA-2017-0190.html
- http://rhn.redhat.com/errata/RHSA-2017-0238.html
- http://www.securityfocus.com/bid/95769
- http://www.securitytracker.com/id/1037693
- https://security.gentoo.org/glsa/201702-13
- https://security.gentoo.org/glsa/201702-22
- https://www.debian.org/security/2017/dsa-3771
- https://www.debian.org/security/2017/dsa-3832
- https://www.mozilla.org/security/advisories/mfsa2017-01/
- https://www.mozilla.org/security/advisories/mfsa2017-02/
- https://www.mozilla.org/security/advisories/mfsa2017-03/
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-01/#CVE-2017-5378
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/#CVE-2017-5378
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-03/#CVE-2017-5378
- https://security-tracker.debian.org/tracker/CVE-2017-5378
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2017-5375
- CVE-2017-5376
- CVE-2017-5378
- CVE-2017-5380
- CVE-2017-5390
- CVE-2017-5396
- CVE-2017-5383
- CVE-2017-5386
- CVE-2017-5373
- CVE-2017-5377
- CVE-2017-5379
- CVE-2017-5389
- CVE-2017-5381
- CVE-2017-5382
- CVE-2017-5384
- CVE-2017-5385
- CVE-2017-5394
- CVE-2017-5391
- CVE-2017-5392
- CVE-2017-5393
- CVE-2017-5395
- CVE-2017-5387
- CVE-2017-5388
- CVE-2017-5374
Frequently Asked Questions
What is the severity of CVE-2017-5378?
CVE-2017-5378 is considered a moderate vulnerability due to potential data leakage from shared JavaScript object hashes.
How do I fix CVE-2017-5378?
To resolve CVE-2017-5378, update Mozilla Firefox and Thunderbird to at least version 45.7.
What software is affected by CVE-2017-5378?
CVE-2017-5378 affects Mozilla Firefox versions earlier than 45.7 and Thunderbird versions earlier than 45.7.
Can CVE-2017-5378 lead to data leakage?
Yes, CVE-2017-5378 may allow for data leakage due to the shared hash codes between JavaScript objects.
Is CVE-2017-5378 a critical vulnerability?
CVE-2017-5378 is not classified as critical but poses significant risk due to its ability to leak sensitive information.
- collector/mozilla-advisory
- collector/security-tracker-debian
- agent/type
- agent/first-publish-date
- source/Mozilla
- agent/software-canonical-lookup
- agent/weakness
- agent/references
- agent/remedy
- agent/severity
- agent/author
- agent/description
- agent/software-canonical-lookup-request
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- vendor/mozilla
- canonical/mozilla firefox esr
- package-manager/debian
- canonical/mozilla thunderbird
- canonical/mozilla firefox
- vendor/debian
- canonical/debian gnu/linux
- version/debian gnu/linux/8.0
- vendor/redhat
- canonical/red hat enterprise linux
- version/red hat enterprise linux/5.0
- version/red hat enterprise linux/6.0
- version/red hat enterprise linux/7.0
- canonical/redhat enterprise linux desktop
- version/redhat enterprise linux desktop/5.0
- version/redhat enterprise linux desktop/6.0
- version/redhat enterprise linux desktop/7.0
- canonical/redhat enterprise linux server
- version/redhat enterprise linux server/5.0
- version/redhat enterprise linux server/6.0
- version/redhat enterprise linux server/7.0
- canonical/redhat enterprise linux server aus
- version/redhat enterprise linux server aus/7.3
- version/redhat enterprise linux server aus/7.4
- canonical/redhat enterprise linux server eus
- version/redhat enterprise linux server eus/7.3
- version/redhat enterprise linux server eus/7.4
- version/redhat enterprise linux server eus/7.5
- canonical/redhat enterprise linux workstation
- version/redhat enterprise linux workstation/5.0
- version/redhat enterprise linux workstation/6.0
- version/redhat enterprise linux workstation/7.0