peter bassill · operator
$ cve CVE-2017-5375 JSON

CVE-2017-5375 EXPLOIT

9.8
CRITICAL · CVSS 3.0 · EPSS 33.8% (pctl 98)

Patch early

A public exploit exists.

Description

JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

Scoring

CVSS9.8 (CRITICAL, v3.0)
VectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS33.77% — more likely to be exploited than 98% of all CVEs
WeaknessCWE-119
On CISA KEVno
Public exploityes
Published2018-06-11
Last modified2026-06-17

Affected (6)

VendorProduct
debiandebian linux
mozillafirefox
mozillathunderbird
redhatenterprise linux desktop
redhatenterprise linux server
redhatenterprise linux workstation

Public exploits

SourceTitleDate
exploit-dbFirefox 46.0.1 - ASM.JS JIT-Spray Remote Code Execution2018-03-16
exploit-dbFirefox 44.0.2 - ASM.JS JIT-Spray Remote Code Execution2018-03-16
exploit-dbFirefox 50.0.1 - ASM.JS JIT-Spray Remote Code Execution2017-07-14

References

→ the Explorer  ·  watch your stack  ·  NVD