CVE-2017-5456: Critical severity Mozilla Firefox vulnerability
A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read and write access to the local file system.
Other sources
A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read only access to the local file system.
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-11/#CVE-2017-5456
Acknowledgements:
Name: the Mozilla project Upstream: Julian Hector
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2017-5433
- CVE-2017-5435
- CVE-2017-5436
- CVE-2017-5461
- CVE-2017-5459
- CVE-2017-5466
- CVE-2017-5434
- CVE-2017-5432
- CVE-2017-5460
- CVE-2017-5438
- CVE-2017-5439
- CVE-2017-5440
- CVE-2017-5441
- CVE-2017-5442
- CVE-2017-5464
- CVE-2017-5443
- CVE-2017-5444
- CVE-2017-5446
- CVE-2017-5447
- CVE-2017-5465
- CVE-2017-5448
- CVE-2016-10196
- CVE-2017-5454
- CVE-2017-5455
- CVE-2017-5456
- CVE-2017-5469
- CVE-2017-5445
- CVE-2017-5449
- CVE-2017-5450
- CVE-2017-5451
- CVE-2017-5462
- CVE-2017-5463
- CVE-2017-5467
- CVE-2017-5452
- CVE-2017-5453
- CVE-2017-5458
- CVE-2017-5468
- CVE-2017-5430
- CVE-2017-5429
Frequently Asked Questions
What is the severity of CVE-2017-5456?
CVE-2017-5456 is classified as a high severity vulnerability that allows unauthorized access to the local file system.
How do I fix CVE-2017-5456?
To fix CVE-2017-5456, update Firefox ESR to version 52.2 or later, or Firefox to version 53.0 or later.
Which versions of Firefox are affected by CVE-2017-5456?
CVE-2017-5456 affects Firefox versions earlier than 53 and Firefox ESR versions up to and including 52.1.
Is CVE-2017-5456 present in Red Hat Enterprise Linux?
Yes, CVE-2017-5456 can affect Red Hat Enterprise Linux versions 7.0, 7.3, 7.4, and 7.5 that include vulnerable Firefox packages.
What is the impact of CVE-2017-5456 on users?
The impact of CVE-2017-5456 is that it allows a malicious actor to bypass file system access protections, potentially leading to unauthorized data access.