CVE-2017-7777
published 2019-04-15CVE-2017-7777: Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function.
PriorityP432high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
1.20%
64.7th percentile
Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | < firefox 54.0-1 (sid) | firefox 54.0-1 (sid) |
| debian | firefox-esr | < firefox 54.0-1 (sid) | firefox 54.0-1 (sid) |
| debian | graphite2 | < firefox 54.0-1 (sid) | firefox 54.0-1 (sid) |
| mozilla | firefox | < 54.0 | 54.0 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= 0 < 54.0+build3-0ubuntu0.14.04.1 | 54.0+build3-0ubuntu0.14.04.1 |
| mozilla | firefox | >= 0 < 54.0+build3-0ubuntu0.16.04.1 | 54.0+build3-0ubuntu0.16.04.1 |
| mozilla | thunderbird | >= 0 < 1:52.2.1+build1-0ubuntu0.14.04.1 | 1:52.2.1+build1-0ubuntu0.14.04.1 |
| mozilla | thunderbird | >= 0 < 1:52.2.1+build1-0ubuntu0.16.04.1 | 1:52.2.1+build1-0ubuntu0.16.04.1 |
| sil | graphite2 | < 1.3.10 | 1.3.10 |
| sil | graphite2 | >= 0 < 1.3.10-1 | 1.3.10-1 |
| sil | graphite2 | >= 0 < 1.3.10-1 | 1.3.10-1 |
| sil | graphite2 | >= 0 < 1.3.10-1 | 1.3.10-1 |
| sil | graphite2 | >= 0 < 1.3.10-1 | 1.3.10-1 |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_ubuntu9.8CRITICAL
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
graphite2 vulnerabilities
vendor_ubuntu·2017-08-21
CVE-2017-7771 graphite2 vulnerabilities
Title: graphite2 vulnerabilities
Summary: graphite2 could be made to crash or run programs if it opened a specially
crafted font.
Holger Fuhrmannek and Tyson Smith discovered that graphite2 incorrectly
handled certain malformed fonts. If a user or automated system were tricked
into opening a specially-crafted font file, a remote attacker could use
this issue to cause graphite2 to crash, resulting in a denial of service,
or possibly execute arbitrary code.
Instructions: This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart applications
using graphite2, such as LibreOffice, to make all the necessary changes.
Ubuntu
Thunderbird vulnerabilities
vendor_ubuntu·2017-07-05·CVSS 9.8
CVE-2017-5470 [CRITICAL] Thunderbird vulnerabilities
Title: Thunderbird vulnerabilities
Summary: Several security issues were fixed in Thunderbird.
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
read uninitialized memory, obtain sensitive information or execute
arbitrary code. (CVE-2017-5470, CVE-2017-5472,
CVE-2017-7749, CVE-2017-7750, CVE-2017-7751, CVE-2017-7752, CVE-2017-7754,
CVE-2017-7756, CVE-2017-7757, CVE-2017-7758, CVE-2017-7764)
Multiple security issues were discovered in the Graphite 2 library used
by Thunderbird. If a user were tricked in to opening a specially crafted
message, an attacker could potentially exploit these to cause a denial of
service, read u
Ubuntu
Firefox vulnerabilities
vendor_ubuntu·2017-06-15·CVSS 9.8
CVE-2017-5470 [CRITICAL] Firefox vulnerabilities
Title: Firefox vulnerabilities
Summary: Firefox could be made to crash or run programs as your login if it
opened a malicious website.
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, read uninitialized
memory, obtain sensitive information, spoof the addressbar contents, or
execute arbitrary code. (CVE-2017-5470, CVE-2017-5471, CVE-2017-5472,
CVE-2017-7749, CVE-2017-7750, CVE-2017-7751, CVE-2017-7752, CVE-2017-7754,
CVE-2017-7756, CVE-2017-7757, CVE-2017-7758, CVE-2017-7762, CVE-2017-7764)
Multiple security issues were discovered in the Graphite 2 library used by
Firefox. If a user were tricked in to opening a specially crafted website,
an attac
Red Hat
graphite2: use of uninitialized memory "graphite2::GlyphCache::Loader::read_glyph"
vendor_redhat·2017-06-14·CVSS 8.8
CVE-2017-7777 [HIGH] CWE-456 graphite2: use of uninitialized memory "graphite2::GlyphCache::Loader::read_glyph"
graphite2: use of uninitialized memory "graphite2::GlyphCache::Loader::read_glyph"
Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function.
The use of uninitialized memory related to "graphite2::GlyphCache::Loader::read_glyph" has been reported in graphite2. An attacker could possibly exploit this flaw to negatively impact the execution of an application using graphite2 in unknown ways.
Debian
CVE-2017-7777: firefox - Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphit...
vendor_debian·2017·CVSS 8.8
CVE-2017-7777 [HIGH] CVE-2017-7777: firefox - Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphit...
Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function.
Scope: local
sid: resolved (fixed in 54.0-1)
GHSA
GHSA-583h-cvpv-jvr9: Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function
ghsa_unreviewed·2022-05-14
CVE-2017-7777 [HIGH] CWE-119 GHSA-583h-cvpv-jvr9: Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function
Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function.
OSV
CVE-2017-7777: Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function
osv·2019-04-15·CVSS 8.8
CVE-2017-7777 [HIGH] CVE-2017-7777: Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function
Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function.
OSV
thunderbird vulnerabilities
osv·2017-07-05·CVSS 9.8
CVE-2017-5470 [CRITICAL] thunderbird vulnerabilities
thunderbird vulnerabilities
Multiple security issues were discovered in Thunderbird. If a user were
tricked in to opening a specially crafted website in a browsing context,
an attacker could potentially exploit these to cause a denial of service,
read uninitialized memory, obtain sensitive information or execute
arbitrary code. (CVE-2017-5470, CVE-2017-5472,
CVE-2017-7749, CVE-2017-7750, CVE-2017-7751, CVE-2017-7752, CVE-2017-7754,
CVE-2017-7756, CVE-2017-7757, CVE-2017-7758, CVE-2017-7764)
Multiple security issues were discovered in the Graphite 2 library used
by Thunderbird. If a user were tricked in to opening a specially crafted
message, an attacker could potentially exploit these to cause a denial of
service, read uninitialized memory, or execute arbitrary code.
(CVE-2017-7771, CVE-
OSV
firefox vulnerabilities
osv·2017-06-15·CVSS 9.8
CVE-2017-5470 [CRITICAL] firefox vulnerabilities
firefox vulnerabilities
Multiple security issues were discovered in Firefox. If a user were
tricked in to opening a specially crafted website, an attacker could
potentially exploit these to cause a denial of service, read uninitialized
memory, obtain sensitive information, spoof the addressbar contents, or
execute arbitrary code. (CVE-2017-5470, CVE-2017-5471, CVE-2017-5472,
CVE-2017-7749, CVE-2017-7750, CVE-2017-7751, CVE-2017-7752, CVE-2017-7754,
CVE-2017-7756, CVE-2017-7757, CVE-2017-7758, CVE-2017-7762, CVE-2017-7764)
Multiple security issues were discovered in the Graphite 2 library used by
Firefox. If a user were tricked in to opening a specially crafted website,
an attacker could potentially exploit these to cause a denial of service,
read uninitialized memory, or execute arbitrar
No detection rules found.
Bugzilla
CVE-2017-7777 graphite2: use of uninitialized memory "graphite2::GlyphCache::Loader::read_glyph"
bugzilla·2017-07-18·CVSS 8.8
CVE-2017-7777 [HIGH] CVE-2017-7777 graphite2: use of uninitialized memory "graphite2::GlyphCache::Loader::read_glyph"
CVE-2017-7777 graphite2: use of uninitialized memory "graphite2::GlyphCache::Loader::read_glyph"
The use of uninitialized memory related to "graphite2::GlyphCache::Loader::read_glyph" has been reported in graphite2. An attacker could possibly exploit this flaw to negatively impact the execution of an application
using graphite2 in unknown ways.
Discussion:
Acknowledgments:
Name: the Mozilla project
Upstream: Holger Fuhrmannek, Tyson Smith
---
External References:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/#CVE-2017-7778
https://sourceforge.net/p/silgraphite/mailman/message/35824024/
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2017:1793 https://access.redhat.com/errata/RHSA-2017:1793
Bugzilla
CVE-2017-7778 Mozilla: Vulnerabilities in the Graphite 2 library (MFSA 2017-16)
bugzilla·2017-06-14·CVSS 8.1
CVE-2017-7778 [HIGH] CVE-2017-7778 Mozilla: Vulnerabilities in the Graphite 2 library (MFSA 2017-16)
CVE-2017-7778 Mozilla: Vulnerabilities in the Graphite 2 library (MFSA 2017-16)
A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2 version 1.3.10.
Please note: Previously, this bug contained a collection of various CVEs. Some CVEs have been moved into separate bugs:
CVE-2017-7771: bug #1472212
CVE-2017-7772: bug #1472213
CVE-2017-7773: bug #1472215
CVE-2017-7774: bug #1472219
CVE-2017-7775: bug #1472221
CVE-2017-7776: bug #1472223
CVE-2017-7777: bug #1472225
External Reference:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/#CVE-2017-7778
Acknowledgements:
Name: the Mozilla project
Upstream: Holger Fuhrmannek, Ty
2019-04-15
Published