Skip to content
OpenAdvisories
Unscored CVE-2017-5376 EUVD-2017-14480GHSA-37qh-mjg8-558v

Use-after-free while manipulating XSL in XSLT documents. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 5…

Published Jun 11, 2018 · Updated Aug 5, 2024 · Assigned by mozilla

Vendor: Mozilla Product: Firefox Product: Firefox ESR Product: Thunderbird Package: firefox Package: firefox-esr Package: firefox-esr Package: thunderbird Category: Browsers Ecosystem: Alpine Ecosystem: Debian Ecosystem: Ubuntu

Description

Use-after-free while manipulating XSL in XSLT documents. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

Affected products

VendorProductAffectedFixed
Mozilla Thunderbird unspecified – < 45.7 45.7
Mozilla Firefox ESR unspecified – < 45.7 45.7
Mozilla Firefox unspecified – < 51 51

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 firefox-esr 45.7.0esr-1 —
Debian 13 firefox-esr 45.7.0esr-1 —
Debian 12 firefox-esr 45.7.0esr-1 —
Debian 8 firefox-esr 45.7.0esr-1~deb8u1 DSA-3771-1
Debian 8 icedove 1:45.8.0-3~deb8u1 DSA-3832-1
Debian 7 firefox-esr 45.7.0esr-1~deb7u1 DLA-800-1
Debian 7 icedove 1:45.8.0-3~deb7u1 DLA-896-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS firefox 51.0.1+build2-0ubuntu0.16.04.1 USN-3175-1
Ubuntu 16.04 LTS thunderbird 1:45.7.0+build1-0ubuntu0.16.04.1 USN-3165-1
Ubuntu 14.04 LTS firefox 51.0.1+build2-0ubuntu0.14.04.1 USN-3175-1
Ubuntu 14.04 LTS thunderbird 1:45.7.0+build1-0ubuntu0.14.04.1 USN-3165-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 firefox 45.7.0-2.el7_3 RHSA-2017:0190
RHEL 7 thunderbird 45.7.0-1.el7_3 RHSA-2017:0238
RHEL 6 firefox 45.7.0-2.el6_8 RHSA-2017:0190
RHEL 6 thunderbird 45.7.0-1.el6_8 RHSA-2017:0238
RHEL 5 firefox 45.7.0-2.el5_11 RHSA-2017:0190
RHEL 5 thunderbird 45.7.0-1.el5_11 RHSA-2017:0238
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Rhel Productivity 5 thunderbird 45.7.0-1.el5_11 RHSA-2017:0238

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 12 SP2 MozillaFirefox 45.7.0esr-99.1 SUSE-SU-2017:0427-1
SLES 12 SP1 MozillaFirefox 45.7.0esr-99.1 SUSE-SU-2017:0427-1
SLES 12 MozillaFirefox 45.7.0esr-99.1 SUSE-SU-2017:0427-1
SLES 11 SP4 MozillaFirefox 45.7.0esr-65.2 SUSE-SU-2017:0426-1
SLES 11 SP3 MozillaFirefox 45.7.0esr-65.2 SUSE-SU-2017:0426-1
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 12 SP2 MozillaFirefox 45.7.0esr-99.1 SUSE-SU-2017:0427-1
SLES for SAP 12 SP1 MozillaFirefox 45.7.0esr-99.1 SUSE-SU-2017:0427-1
SLES for SAP 12 MozillaFirefox 45.7.0esr-99.1 SUSE-SU-2017:0427-1
SLES for SAP 11 SP4 MozillaFirefox 45.7.0esr-65.2 SUSE-SU-2017:0426-1
SUSE Package Hub 12 MozillaThunderbird 45.7.0-23.1 openSUSE-SU-2017:0357-1, openSUSE-SU-2017:0354-1
SUSE OpenStack Cloud 5 MozillaFirefox 45.7.0esr-65.2 SUSE-SU-2017:0426-1
SUSE Manager Proxy 2.1 MozillaFirefox 45.7.0esr-65.2 SUSE-SU-2017:0426-1
SUSE Manager 2.1 MozillaFirefox 45.7.0esr-65.2 SUSE-SU-2017:0426-1
SUSE Linux Enterprise Point of Sale 11 SP3 MozillaFirefox 45.7.0esr-65.2 SUSE-SU-2017:0426-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed MozillaFirefox 92.0-1.2 openSUSE-SU-2024:10600-1
openSUSE Tumbleweed MozillaThunderbird 91.1.1-1.1 openSUSE-SU-2024:10601-1
openSUSE Tumbleweed firefox-esr 128.5.1-1.1 openSUSE-SU-2024:14572-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.5 firefox-esr 45.7.0-r0 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 firefox +1 45.7.0-1.0.1.el7_3 ELSA-2017-0238, ELSA-2017-0190

Advisories 17

References