CVE-2017-5454: Infoleak
A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2017-5433
- CVE-2017-5435
- CVE-2017-5436
- CVE-2017-5461
- CVE-2017-5459
- CVE-2017-5466
- CVE-2017-5434
- CVE-2017-5432
- CVE-2017-5460
- CVE-2017-5438
- CVE-2017-5439
- CVE-2017-5440
- CVE-2017-5441
- CVE-2017-5442
- CVE-2017-5464
- CVE-2017-5443
- CVE-2017-5444
- CVE-2017-5446
- CVE-2017-5447
- CVE-2017-5465
- CVE-2016-10196
- CVE-2017-5454
- CVE-2017-5469
- CVE-2017-5445
- CVE-2017-5449
- CVE-2017-5451
- CVE-2017-5462
- CVE-2017-5467
- CVE-2017-5430
- CVE-2017-5429
- CVE-2017-5448
- CVE-2017-5455
- CVE-2017-5456
- CVE-2017-5450
- CVE-2017-5463
- CVE-2017-5452
- CVE-2017-5453
- CVE-2017-5458
- CVE-2017-5468
Frequently Asked Questions
What is the severity of CVE-2017-5454?
CVE-2017-5454 is classified as a high severity vulnerability due to its potential to bypass file system access protections.
How do I fix CVE-2017-5454?
To mitigate CVE-2017-5454, update affected software such as Mozilla Thunderbird to version 52.1 or higher, and Mozilla Firefox to version 53 or higher.
Which products are affected by CVE-2017-5454?
CVE-2017-5454 affects Mozilla Thunderbird versions prior to 52.1, Mozilla Firefox ESR prior to 52.1, and Mozilla Firefox versions prior to 53.
Can CVE-2017-5454 allow access to sensitive files?
Yes, CVE-2017-5454 enables read-only access to the local file system, which can expose sensitive files if exploited.
Is CVE-2017-5454 related to file picker functionality?
Yes, CVE-2017-5454 specifically allows for bypassing file system protections in the sandbox related to the file picker.