CVE-2017-7749 — Use After Free in Mozilla Firefox

CWE-416 — Use After Free11 documents8 sources

Severity

9.8CRITICALNVD

EPSS

1.9%

top 16.85%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mozilla Firefox Mozilla Firefox ESR Mozilla Thunderbird +7 more

Timeline

PublishedJun 11

Latest updateMay 14

Description

A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This results in a potentially exploitable crash. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages10 packages

▶CVEListV5mozilla/firefoxunspecified — 54

▶NVDmozilla/firefox< 54.0+1

▶CVEListV5mozilla/firefox_esrunspecified — 52.2

▶Ubuntumozilla/firefox< 54.0+build3-0ubuntu0.14.04.1+1

▶CVEListV5mozilla/thunderbirdunspecified — 52.2

Also affects: Debian Linux 8.0, 9.0, Enterprise Linux 6.0, 7.0, 7.3, 7.4, 7.5

Patches

Patch: bugzilla.mozilla.org ↗Patch: bugzilla.mozilla.org ↗

🔴Vulnerability Details

GHSA

GHSA-h85h-x834-x2gf: A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell↗2022-05-14

▶

CVEList

CVE-2017-7749: A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell↗2018-06-11

▶

OSV

CVE-2017-7749: A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell↗2018-06-11

▶

OSV

thunderbird vulnerabilities↗2017-07-05

▶

OSV

firefox vulnerabilities↗2017-06-15

▶

📋Vendor Advisories

Ubuntu

Thunderbird vulnerabilities↗2017-07-05

▶

Ubuntu

Firefox vulnerabilities↗2017-06-15

▶

Red Hat

Mozilla: Use-after-free during docshell reloading (MFSA 2017-16)↗2017-06-14

▶

Debian

CVE-2017-7749: firefox - A use-after-free vulnerability when using an incorrect URL during the reloading ...↗2017

▶

💬Community

Bugzilla

CVE-2017-7749 Mozilla: Use-after-free during docshell reloading (MFSA 2017-16)↗2017-06-14

▶