VDB
CVE-2017-5454
CVE-2017-5454
PUBLISHED
A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of relative paths. This allows for read only access to the local file system. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.
EPSS 0.53% · 67.8th percentile
Risk Scores
EPSS Score
0.53%
67.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:14.04:LTS | thunderbird | *, 1:45.3.0+build1-0ubuntu0.14.04.4, 1:45.4.0+build1-0ubuntu0.14.04.1 |
| Ubuntu:16.04:LTS | thunderbird | *, 0, 1:38.3.0+build1-0ubuntu2 |
| Ubuntu:14.04:LTS | firefox | 50.1.0+build2-0ubuntu0.14.04.1, 51.0.1+build2-0ubuntu0.14.04.1, 51.0.1+build2-0ubuntu0.14.04.2 |
| Ubuntu:16.04:LTS | firefox | 0, 41.0.2+build2-0ubuntu1, 42.0+build2-0ubuntu1 |
Timeline
- Apr 20, 2017 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- Feb 28, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Nov 6, 2022 EPSS Score
- Jan 8, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2017-5454 third-party-advisory
- https://www.mozilla.org/en-US/security/advisories/mfsa2017-10/#CVE-2017-5454 third-party-advisory
- https://ubuntu.com/security/notices/USN-3260-1 vendor-advisory
- https://ubuntu.com/security/notices/USN-3278-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2017-5454 third-party-advisory