CVE-2017-7845Improper Restriction of Operations within the Bounds of a Memory Buffer in Mozilla Firefox

Severity
8.8HIGHNVD
EPSS
0.8%
top 26.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedJun 11
Latest updateMay 14

Description

A buffer overflow occurs when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library, used for WebGL content. This is due to an incorrect value being passed within the library during checks and results in a potentially exploitable crash. Note: This attack only affects Windows operating systems. Other operating systems are unaffected. This vulnerability affects Thunderbird < 52.5.2, Firefox ESR < 52.5.2, and Firefox < 57.0.2.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages8 packages

CVEListV5mozilla/firefoxunspecified57.0.2
NVDmozilla/firefox< 52.5.2+1
CVEListV5mozilla/firefox_esrunspecified52.5.2

🔴Vulnerability Details

1
GHSA
GHSA-3rhj-p6qq-r5mv: A buffer overflow occurs when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library, used for WebGL content2022-05-14

📋Vendor Advisories

1
Debian
CVE-2017-7845: firefox - A buffer overflow occurs when drawing and validating elements using Direct 3D 9 ...2017