A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.
References
| Link | Resource |
|---|---|
| https://www.mozilla.org/security/advisories/mfsa2017-13/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2017-12/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2017-10/ | Vendor Advisory |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1349276 | Issue Tracking Patch Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2017:1201 | Third Party Advisory |
| https://access.redhat.com/errata/RHSA-2017:1106 | Third Party Advisory |
| http://www.securitytracker.com/id/1038320 | Third Party Advisory VDB Entry |
| http://www.securityfocus.com/bid/97940 | Third Party Advisory VDB Entry |
Advertisement
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Information
Published : 2018-06-11 14:29
Updated : 2018-08-09 08:34
NVD link : CVE-2017-5454
Mitre link : CVE-2017-5454
JSON object : View
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
Advertisement
Products Affected
redhat
- enterprise_linux_desktop
- enterprise_linux
- enterprise_linux_workstation
- enterprise_linux_server_aus
- enterprise_linux_server_eus
- enterprise_linux_server
mozilla
- firefox_esr
- thunderbird
- firefox