CVE-2017-7805: Use After Free
During TLS 1.2 exchanges, handshake hashes are generated which point to a message buffer. This saved data is used for later messages but in some cases, the handshake transcript can exceed the space available in the current buffer, causing the allocation of a new buffer. This leaves a pointer pointing to the old, freed buffer, resulting in a use-after-free when handshake hashes are then calculated afterwards. This can result in a potentially exploitable crash.
Other sources
Potential use-after-free vulnerability in nss in TLS 1.2 server when verifying client authentication was found.
Upstream bug:
https://bugzilla.mozilla.org/showbug.cgi?id=1377618
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Thunderbirdto a version that resolves this vulnerability.Fixed in 52.4 - Upgrade
Upgrade
Firefoxto a version that resolves this vulnerability.Fixed in 56 - Upgrade
Upgrade
Firefox ESRto a version that resolves this vulnerability.Fixed in 52.4 - Upgrade
Upgrade
debian/firefoxto a version that resolves this vulnerability.Fixed in 159.0.1-1 - Upgrade
Upgrade
debian/firefox-esrto a version that resolves this vulnerability.Fixed in 140.12.0esr-1~deb12u1Fixed in 153.6.0esr-1~deb12u2Fixed in 140.15.0esr-1~deb13u1Fixed in 153.6.0esr-1~deb13u1Fixed in 153.5.1esr-1Fixed in 153.6.0esr-1 - Upgrade
Upgrade
debian/nssto a version that resolves this vulnerability.Fixed in 2:3.87.1-1+deb12u2Fixed in 2:3.87.1-1+deb12u4Fixed in 2:3.110-1+deb13u4Fixed in 2:3.110-1+deb13u5Fixed in 2:3.132-1 - Upgrade
Upgrade
debian/thunderbirdto a version that resolves this vulnerability.Fixed in 1:140.12.0esr-1~deb12u1Fixed in 1:153.6.0esr-1~deb12u2Fixed in 1:140.12.0esr-1~deb13u1Fixed in 1:153.6.0esr-1~deb13u1Fixed in 1:153.5.0esr-1Fixed in 1:153.6.0esr-1
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2017-7805?
CVE-2017-7805 is a vulnerability in Mozilla Firefox and Thunderbird that allows an attacker to cause a denial of service or execute arbitrary code.
What is the severity of CVE-2017-7805?
CVE-2017-7805 has a severity rating of high.
How does CVE-2017-7805 affect Mozilla Firefox and Thunderbird?
CVE-2017-7805 affects Mozilla Firefox versions up to and including 56.0 and Thunderbird versions up to and including 52.4.0.
How can I fix CVE-2017-7805?
To fix CVE-2017-7805, update Mozilla Firefox to version 56.0+ and Thunderbird to version 52.4.0+.
Where can I find more information about CVE-2017-7805?
You can find more information about CVE-2017-7805 in the Mozilla Bugzilla, Mozilla Security Advisories, and Oracle Security Advisory.