CVE-2017-5396: Use After Free
A use-after-free vulnerability in the Media Decoder when working with media files when some events are fired after the media elements are freed from memory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 118.0.2-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 91.12.0esr-1~deb10u1Fixed in 115.3.1esr-1~deb10u1Fixed in 102.15.0esr-1~deb11u1Fixed in 115.3.1esr-1~deb11u1Fixed in 102.15.1esr-1~deb12u1Fixed in 115.3.0esr-1~deb12u1Fixed in 115.3.0esr-1Fixed in 115.4.0esr-1 - Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 45.7 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 51 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 45.7 - Upgrade
Upgrade
alpine/firefox-esrto a version that resolves this vulnerability.Fixed in 45.7.0-r0
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2017-5375
- CVE-2017-5376
- CVE-2017-5378
- CVE-2017-5380
- CVE-2017-5390
- CVE-2017-5396
- CVE-2017-5383
- CVE-2017-5373
- CVE-2017-5377
- CVE-2017-5379
- CVE-2017-5389
- CVE-2017-5381
- CVE-2017-5382
- CVE-2017-5384
- CVE-2017-5385
- CVE-2017-5386
- CVE-2017-5394
- CVE-2017-5391
- CVE-2017-5392
- CVE-2017-5393
- CVE-2017-5395
- CVE-2017-5387
- CVE-2017-5388
- CVE-2017-5374
Frequently Asked Questions
What is the severity of CVE-2017-5396?
CVE-2017-5396 has a high severity rating due to the potential for exploitation leading to application crashes or execution of arbitrary code.
How do I fix CVE-2017-5396?
To fix CVE-2017-5396, users should update to the latest version of affected software such as Mozilla Firefox ESR 45.7 or other patched releases.
Is CVE-2017-5396 present in the latest versions of Firefox?
No, CVE-2017-5396 has been resolved in versions of Firefox released after version 45.7.
What types of software are affected by CVE-2017-5396?
CVE-2017-5396 affects Mozilla Firefox, Thunderbird, and their respective Extended Support Releases.
How can I determine if I am vulnerable to CVE-2017-5396?
You can determine your vulnerability to CVE-2017-5396 by checking your software version against the list of affected versions.