CVE-2017-5456 — Incorrect Permission Assignment in Mozilla Firefox
Severity
9.8CRITICALNVD
EPSS
0.3%
top 42.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJun 11
Latest updateMay 13
Description
A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read and write access to the local file system. This vulnerability affects Firefox ESR < 52.1 and Firefox < 53.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9
Affected Packages7 packages
Also affects: Enterprise Linux 7.0, 7.3, 7.4, 7.5
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-59p4-f6m8-9792: A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message↗2022-05-13
CVEList▶
CVE-2017-5456: A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message↗2018-06-11
OSV▶
CVE-2017-5456: A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message↗2017-04-20
📋Vendor Advisories
3💬Community
1Bugzilla▶
CVE-2017-5456 Mozilla: Sandbox escape allowing local file system read access (MFSA 2017-12)↗2017-04-19