7.5

CVE-2017-5425

EPSS 0.49%
Veröffentlicht 11.06.2018 21:29:05
Zuletzt bearbeitet 21.11.2024 03:27:35
Quelle security@mozilla.org
CVE-Watchlists
Login
Unerledigt
Login

The Gecko Media Plugin sandbox allows access to local files that match specific regular expressions. On OS OX, this matching allows access to some data in subdirectories of "/private/var" that could expose personal or temporary data. This has been updated to not allow access to "/private/var" and its subdirectories. Note: this issue only affects OS X. Other operating systems are not affected. This vulnerability affects Firefox < 52 and Thunderbird < 52.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 8

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Mozilla ≫ Firefox Version < 52.0

Apple ≫ macOS X Version-

Mozilla ≫ Thunderbird Version < 52.0

Apple ≫ macOS X Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.49%	0.648

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	7.5	3.9	3.6	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov	5	10	2.9	AV:N/AC:L/Au:N/C:P/I:N/A:N

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://www.securitytracker.com/id/1037966

Third Party Advisory

VDB Entry

https://www.mozilla.org/security/advisories/mfsa2017-05/

Vendor Advisory

https://www.mozilla.org/security/advisories/mfsa2017-09/

Vendor Advisory

http://www.securityfocus.com/bid/96692

Third Party Advisory

VDB Entry

https://bugzilla.mozilla.org/show_bug.cgi?id=1322716

Vendor Advisory

Issue Tracking

https://nvd.nist.gov/vuln/detail/CVE-2017-5425

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2017-5425

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2017-5425

EUVD