CVE-2017-5425 — Sensitive Information Exposure in Mozilla Firefox

CWE-200 — Sensitive Information Exposure3 documents3 sources
Severity
7.5HIGHNVD
EPSS
0.5%
top 35.50%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Mozilla FirefoxMozilla ThunderbirdDebian Firefox
Timeline
PublishedJun 11
Latest updateMay 14

Description

The Gecko Media Plugin sandbox allows access to local files that match specific regular expressions. On OS OX, this matching allows access to some data in subdirectories of "/private/var" that could expose personal or temporary data. This has been updated to not allow access to "/private/var" and its subdirectories. Note: this issue only affects OS X. Other operating systems are not affected. This vulnerability affects Firefox < 52 and Thunderbird < 52.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5mozilla/firefoxunspecified — 52
▶NVDmozilla/firefox< 52.0
▶CVEListV5mozilla/thunderbirdunspecified — 52

🔴Vulnerability Details

1
GHSA
GHSA-5hrj-7m57-cr8j: The Gecko Media Plugin sandbox allows access to local files that match specific regular expressions↗2022-05-14
▶

📋Vendor Advisories

1
Debian
CVE-2017-5425: firefox - The Gecko Media Plugin sandbox allows access to local files that match specific ...↗2017
▶