Ubuntu.comUB:CVE-2017-5454CVE-2017-5454
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
68.3%
A mechanism to bypass file system access protections in the sandbox to use
the file picker to access different files than those selected in the file
picker through the use of relative paths. This allows for read only access
to the local file system. This vulnerability affects Thunderbird < 52.1,
Firefox ESR < 52.1, and Firefox < 53.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| ubuntu | 14.04 | noarch | firefox | < 53.0+build6-0ubuntu0.14.04.1 | UNKNOWN |
| ubuntu | 16.04 | noarch | firefox | < 53.0+build6-0ubuntu0.16.04.1 | UNKNOWN |
| ubuntu | 16.10 | noarch | firefox | < 53.0+build6-0ubuntu0.16.10.1 | UNKNOWN |
| ubuntu | 17.04 | noarch | firefox | < 53.0+build6-0ubuntu0.17.04.1 | UNKNOWN |
| ubuntu | 14.04 | noarch | thunderbird | < 1:52.1.1+build1-0ubuntu0.14.04.1 | UNKNOWN |
| ubuntu | 16.04 | noarch | thunderbird | < 1:52.1.1+build1-0ubuntu0.16.04.1 | UNKNOWN |
| ubuntu | 16.10 | noarch | thunderbird | < 1:52.1.1+build1-0ubuntu0.16.10.1 | UNKNOWN |
| ubuntu | 17.04 | noarch | thunderbird | < 1:52.1.1+build1-0ubuntu0.17.04.1 | UNKNOWN |
References
launchpad.net/bugs/cve/CVE-2017-5454
nvd.nist.gov/vuln/detail/CVE-2017-5454
security-tracker.debian.org/tracker/CVE-2017-5454
ubuntu.com/security/notices/USN-3260-1
ubuntu.com/security/notices/USN-3278-1
www.cve.org/CVERecord?id=CVE-2017-5454
www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5454
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
Percentile
68.3%