CVE-2017-7771

Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Pass::readPass function.

Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox (CVE-2017-5470, CVE-2017-5472, CVE-2017-7749, CVE-2017-7751, CVE-2017-7756, CVE-2017-7771, CVE-2017-7772, CVE-2017-7773, CVE-2017-7774, CVE-2017-7775, CVE-2017-7776, CVE-2017-7777, CVE-2017-7778, CVE-2017-7750, CVE-2017-7752, CVE-2017-7754, CVE-2017-7757, CVE-2017-7758, CVE-2017-7764).

An out-of-bounds write triggered with a maliciously crafted Graphite font could lead to a crash or potentially code execution (CVE-2017-5436).

Multiple vulnerabilities have been found in the Graphite font rendering engine which might result in denial of service or the execution of arbitrary code if a malformed font file is processed (CVE-2017-7771, CVE-2017-7772, CVE-2017-7773, CVE-2017-7774, CVE-2017-7775, CVE-2017-7776, CVE-2017-7777, CVE-2017-7778).

This update to Thunderbird 52.2 fixes security issues and bugs.

The following vulnerabilities were fixed:

• CVE-2017-5472: Use-after-free using destroyed node when regenerating trees
• CVE-2017-7749: Use-after-free during docshell reloading
• CVE-2017-7750: Use-after-free with track elements
• CVE-2017-7751: Use-after-free with content viewer listeners
• CVE-2017-7752: Use-after-free with IME input
• CVE-2017-7754: Out-of-bounds read in WebGL with ImageInfo object
• CVE-2017-7756: Use-after-free and use-after-scope logging XHR header errors
• CVE-2017-7757: Use-after-free in IndexedDB
• CVE-2017-7778, CVE-2017-7778, CVE-2017-7771, CVE-2017-7772, CVE-2017-7773, CVE-2017-7774, CVE-2017-7775, CVE-2017-7776, CVE-2017-7777: Vulnerabilities in the Graphite 2 library
• CVE-2017-7758: Out-of-bounds read in Opus encoder
• CVE-2017-7764: Domain spoofing with combination of Canadian Syllabics and other unicode blocks
• CVE-2017-5470: Memory safety bugs fixed in Firefox 54 and Firefox ESR 52.2

Mozilla Thunderbird now requires NSS 3.28.5.

The following bugs were fixed:

• Embedded images not shown in email received from Hotmail/Outlook webmailer
• Detection of non-ASCII font names in font selector
• Attachment not forwarded correctly under certain circumstances
• Multiple requests for master password when GMail OAuth2 is enabled
• Large number of blank pages being printed under certain circumstances when invalid preferences were present
• Messages sent via the Simple MAPI interface are forced to HTML
• Calendar: Invitations can't be printed
• Mailing list (group) not accessible from macOS or Outlook address book
• Clicking on links with references/anchors where target doesn't exist in the message not opening in external browser

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, obtain sensitive information, spoof the addressbar contents, or execute arbitrary code. (CVE-2017-5470, CVE-2017-5471, CVE-2017-5472, CVE-2017-7749, CVE-2017-7750, CVE-2017-7751, CVE-2017-7752, CVE-2017-7754, CVE-2017-7756, CVE-2017-7757, CVE-2017-7758, CVE-2017-7762, CVE-2017-7764)

Multiple security issues were discovered in the Graphite 2 library used by Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, or execute arbitrary code. (CVE-2017-7771, CVE-2017-7772, CVE-2017-7773, CVE-2017-7774, CVE-2017-7775, CVE-2017-7776, CVE-2017-7777, CVE-2017-7778)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, obtain sensitive information or execute arbitrary code. (CVE-2017-5470, CVE-2017-5472, CVE-2017-7749, CVE-2017-7750, CVE-2017-7751, CVE-2017-7752, CVE-2017-7754, CVE-2017-7756, CVE-2017-7757, CVE-2017-7758, CVE-2017-7764)

Multiple security issues were discovered in the Graphite 2 library used by Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service, read uninitialized memory, or execute arbitrary code. (CVE-2017-7771, CVE-2017-7772, CVE-2017-7773, CVE-2017-7774, CVE-2017-7775, CVE-2017-7776, CVE-2017-7777, CVE-2017-7778)

Holger Fuhrmannek and Tyson Smith discovered that graphite2 incorrectly handled certain malformed fonts. If a user or automated system were tricked into opening a specially-crafted font file, a remote attacker could use this issue to cause graphite2 to crash, resulting in a denial of service, or possibly execute arbitrary code.