CVE-2017-5381: Path Traversal
The "export" function in the Certificate Viewer can force local filesystem navigation when the "common name" in a certificate contains slashes, allowing certificate content to be saved in unsafe locations with an arbitrary filename.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2017-5375
- CVE-2017-5376
- CVE-2017-5377
- CVE-2017-5378
- CVE-2017-5379
- CVE-2017-5380
- CVE-2017-5390
- CVE-2017-5389
- CVE-2017-5396
- CVE-2017-5381
- CVE-2017-5382
- CVE-2017-5383
- CVE-2017-5384
- CVE-2017-5385
- CVE-2017-5386
- CVE-2017-5394
- CVE-2017-5391
- CVE-2017-5392
- CVE-2017-5393
- CVE-2017-5395
- CVE-2017-5387
- CVE-2017-5388
- CVE-2017-5374
- CVE-2017-5373
Frequently Asked Questions
What is the severity of CVE-2017-5381?
CVE-2017-5381 is considered a moderate severity vulnerability due to its potential for unauthorized file system access.
How do I fix CVE-2017-5381?
To fix CVE-2017-5381, update Mozilla Firefox to version 51.0 or later.
What impact does CVE-2017-5381 have on Mozilla Firefox users?
CVE-2017-5381 allows attackers to manipulate the export functionality to save sensitive certificate data in unsafe locations.
Which versions of Firefox are affected by CVE-2017-5381?
CVE-2017-5381 affects all versions of Mozilla Firefox prior to 51.0.
Is there a workaround for CVE-2017-5381 pending a software update?
There is no official workaround for CVE-2017-5381; users are advised to update Firefox as soon as possible.