Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address can be discovered through hash codes, and also allows for data leakage of an object's content using these hash codes. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.
References
| Link | Resource |
|---|---|
| https://www.mozilla.org/security/advisories/mfsa2017-03/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2017-02/ | Vendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2017-01/ | Vendor Advisory |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1330769 | Issue Tracking Patch Vendor Advisory |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1312001 | Exploit Issue Tracking Vendor Advisory |
| https://www.debian.org/security/2017/dsa-3832 | Third Party Advisory |
| https://www.debian.org/security/2017/dsa-3771 | Third Party Advisory |
| https://security.gentoo.org/glsa/201702-22 | Third Party Advisory |
| https://security.gentoo.org/glsa/201702-13 | Third Party Advisory |
| http://www.securitytracker.com/id/1037693 | Third Party Advisory VDB Entry |
| http://www.securityfocus.com/bid/95769 | Third Party Advisory VDB Entry |
| http://rhn.redhat.com/errata/RHSA-2017-0238.html | Third Party Advisory |
| http://rhn.redhat.com/errata/RHSA-2017-0190.html | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
History
No history.
Information
Published : 2018-06-11 21:29
Updated : 2018-08-02 19:43
NVD link : CVE-2017-5378
Mitre link : CVE-2017-5378
JSON object : View
Products Affected
debian
- debian_linux
redhat
- enterprise_linux_server_eus
- enterprise_linux
- enterprise_linux_desktop
- enterprise_linux_server
- enterprise_linux_server_aus
- enterprise_linux_workstation
mozilla
- thunderbird
- firefox_esr
- firefox
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor