CVE-2017-5390: Critical severity Mozilla Thunderbird vulnerability
The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for copying and viewing JSON or HTTP headers data, allowing for potential privilege escalation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 118.0.2-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 91.12.0esr-1~deb10u1Fixed in 115.3.1esr-1~deb10u1Fixed in 102.15.0esr-1~deb11u1Fixed in 115.3.1esr-1~deb11u1Fixed in 102.15.1esr-1~deb12u1Fixed in 115.3.0esr-1~deb12u1Fixed in 115.3.0esr-1Fixed in 115.4.0esr-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 45.7 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 51 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 45.7 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 45.7.0-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2017-5375
- CVE-2017-5376
- CVE-2017-5378
- CVE-2017-5380
- CVE-2017-5390
- CVE-2017-5396
- CVE-2017-5383
- CVE-2017-5373
- CVE-2017-5377
- CVE-2017-5379
- CVE-2017-5389
- CVE-2017-5381
- CVE-2017-5382
- CVE-2017-5384
- CVE-2017-5385
- CVE-2017-5386
- CVE-2017-5394
- CVE-2017-5391
- CVE-2017-5392
- CVE-2017-5393
- CVE-2017-5395
- CVE-2017-5387
- CVE-2017-5388
- CVE-2017-5374
Frequently Asked Questions
What is the severity of CVE-2017-5390?
CVE-2017-5390 has been classified as a high severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2017-5390?
To fix CVE-2017-5390, update affected software versions of Firefox, Firefox ESR, or Thunderbird to their remedied versions.
What products are affected by CVE-2017-5390?
CVE-2017-5390 affects Mozilla Firefox and Firefox ESR versions up to 45.7, and Thunderbird versions up to 45.7.
What are the potential impacts of CVE-2017-5390?
The potential impacts of CVE-2017-5390 include unauthorized access to sensitive data via insecure communication channels.
Is CVE-2017-5390 a critical vulnerability?
CVE-2017-5390 is not classified as critical but is significant due to its ability to lead to privilege escalation and data exposure.