CVEvulnerability
CVE-2017-5454
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-06-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-200
Description
A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.
Affected configurations
• redhat enterprise linux 6.0
• redhat enterprise linux 7.0
• redhat enterprise linux desktop 6.0
• redhat enterprise linux desktop 7.0
• redhat enterprise linux server 6.0
• redhat enterprise linux server 7.0
• redhat enterprise linux server aus 7.3
• redhat enterprise linux server aus 7.4
• redhat enterprise linux server eus 7.3
• redhat enterprise linux server eus 7.4
• redhat enterprise linux server eus 7.5
• redhat enterprise linux workstation 6.0
• redhat enterprise linux workstation 7.0
• mozilla firefox (< 53.0)
• mozilla firefox (< 52.1.0)
• mozilla thunderbird (< 52.1.0)
Related
Weakness · CWE (1)
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
References
- http://www.securityfocus.com/bid/97940 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038320 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2017:1106 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1201 Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1349276 Issue Tracking, Patch, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-10/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-12/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-13/ Vendor Advisory
- http://www.securityfocus.com/bid/97940 Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038320 Third Party Advisory, VDB Entry
- https://access.redhat.com/errata/RHSA-2017:1106 Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:1201 Third Party Advisory
- https://bugzilla.mozilla.org/show_bug.cgi?id=1349276 Issue Tracking, Patch, Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-10/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-12/ Vendor Advisory
- https://www.mozilla.org/security/advisories/mfsa2017-13/ Vendor Advisory