NVD Vulnerability Detail

CVE-2017-7778

Summary	A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2 version 1.3.10. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.
Publication Date	June 12, 2018, 6:29 a.m.
Registration Date	Jan. 26, 2021, 1:29 p.m.
Last Update	Nov. 21, 2024, 12:32 p.m.

CVSS3.0 : CRITICAL
スコア	9.8
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃に必要な特権レベル(PR)	不要
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高

CVSS2.0 : HIGH
Score	7.5
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
攻撃元区分(AV)	ネットワーク
攻撃条件の複雑さ(AC)	低
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	低
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:mozilla:firefox::::::::				54.0
cpe:2.3:a:mozilla:thunderbird::::::::				52.2.0
cpe:2.3:a:mozilla:firefox_esr::::::::				52.2.0

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:8.0:::::::*
cpe:2.3:o:debian:debian_linux:9.0:::::::*

Configuration3		or higher	or less	more than	less than
cpe:2.3:a:sil:graphite2::::::::					1.3.10

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/99057	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/99057	Third Party Advisory VDB Entry
3	http://www.securitytracker.com/id/1038689	Third Party Advisory VDB Entry
4	http://www.securitytracker.com/id/1038689	Third Party Advisory VDB Entry
5	https://access.redhat.com/errata/RHSA-2017:1440	Third Party Advisory
6	https://access.redhat.com/errata/RHSA-2017:1440	Third Party Advisory
7	https://access.redhat.com/errata/RHSA-2017:1561	Third Party Advisory
8	https://access.redhat.com/errata/RHSA-2017:1561	Third Party Advisory
9	https://access.redhat.com/errata/RHSA-2017:1793	Third Party Advisory
10	https://access.redhat.com/errata/RHSA-2017:1793	Third Party Advisory
11	https://bugzilla.mozilla.org/show_bug.cgi?id=1349310	Issue Tracking Vendor Advisory
12	https://bugzilla.mozilla.org/show_bug.cgi?id=1349310	Issue Tracking Vendor Advisory
13	https://bugzilla.mozilla.org/show_bug.cgi?id=1350047	Issue Tracking Vendor Advisory
14	https://bugzilla.mozilla.org/show_bug.cgi?id=1350047	Issue Tracking Vendor Advisory
15	https://bugzilla.mozilla.org/show_bug.cgi?id=1352745	Issue Tracking Vendor Advisory
16	https://bugzilla.mozilla.org/show_bug.cgi?id=1352745	Issue Tracking Vendor Advisory
17	https://bugzilla.mozilla.org/show_bug.cgi?id=1352747	Issue Tracking Vendor Advisory
18	https://bugzilla.mozilla.org/show_bug.cgi?id=1352747	Issue Tracking Vendor Advisory
19	https://bugzilla.mozilla.org/show_bug.cgi?id=1355174	Issue Tracking Vendor Advisory
20	https://bugzilla.mozilla.org/show_bug.cgi?id=1355174	Issue Tracking Vendor Advisory
21	https://bugzilla.mozilla.org/show_bug.cgi?id=1355182	Issue Tracking Vendor Advisory
22	https://bugzilla.mozilla.org/show_bug.cgi?id=1355182	Issue Tracking Vendor Advisory
23	https://bugzilla.mozilla.org/show_bug.cgi?id=1356607	Issue Tracking Vendor Advisory
24	https://bugzilla.mozilla.org/show_bug.cgi?id=1356607	Issue Tracking Vendor Advisory
25	https://bugzilla.mozilla.org/show_bug.cgi?id=1358551	Issue Tracking Vendor Advisory
26	https://bugzilla.mozilla.org/show_bug.cgi?id=1358551	Issue Tracking Vendor Advisory
27	https://security.gentoo.org/glsa/201710-13	Third Party Advisory
28	https://security.gentoo.org/glsa/201710-13	Third Party Advisory
29	https://www.debian.org/security/2017/dsa-3881	Third Party Advisory
30	https://www.debian.org/security/2017/dsa-3881	Third Party Advisory
31	https://www.debian.org/security/2017/dsa-3894	Third Party Advisory
32	https://www.debian.org/security/2017/dsa-3894	Third Party Advisory
33	https://www.debian.org/security/2017/dsa-3918	Third Party Advisory
34	https://www.debian.org/security/2017/dsa-3918	Third Party Advisory
35	https://www.mozilla.org/security/advisories/mfsa2017-15/	Vendor Advisory
36	https://www.mozilla.org/security/advisories/mfsa2017-15/	Vendor Advisory
37	https://www.mozilla.org/security/advisories/mfsa2017-16/	Vendor Advisory
38	https://www.mozilla.org/security/advisories/mfsa2017-16/	Vendor Advisory
39	https://www.mozilla.org/security/advisories/mfsa2017-17/	Vendor Advisory
40	https://www.mozilla.org/security/advisories/mfsa2017-17/	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-119	バッファエラー	https://cwe.mitre.org/data/definitions/118.html
2	CWE-125	境界外読み取り	https://cwe.mitre.org/data/definitions/125.html
3	CWE-787	境界外書き込み	https://cwe.mitre.org/data/definitions/787.html

JVN Vulnerability Information

Graphite 2 におけるバッファエラーの脆弱性

Title	Graphite 2 におけるバッファエラーの脆弱性
Summary	Graphite 2 には、バッファエラーの脆弱性、境界外読み取りに関する脆弱性、および境界外書き込みに関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 13, 2017, midnight
Registration Date	Aug. 28, 2018, 5:17 p.m.
Last Update	Aug. 28, 2018, 5:17 p.m.

Affected System

Mozilla Foundation

Mozilla Firefox 54 未満

Mozilla Firefox ESR 52.2 未満

Mozilla Thunderbird 52.2 未満

Debian

Debian GNU/Linux

SIL International

Graphite2 1.3.10

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-7778	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7778
National Vulnerability Database (NVD)
2	CVE-2017-7778	https://nvd.nist.gov/vuln/detail/CVE-2017-7778

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-119	https://jvndb.jvn.jp/ja/cwe/CWE-119.html
2	CWE-125	https://cwe.mitre.org/data/definitions/125.html
3	CWE-787	https://cwe.mitre.org/data/definitions/787.html

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-3881	https://www.debian.org/security/2017/dsa-3881
2	DSA-3894	https://www.debian.org/security/2017/dsa-3894
3	DSA-3918	https://www.debian.org/security/2017/dsa-3918
Graphite
4	Top Page	https://scripts.sil.org/cms/scripts/page.php?site_id=projects&item_id=graphite_home
Mozilla Bugzilla
5	Bug 1349310	https://bugzilla.mozilla.org/show_bug.cgi?id=1349310
6	Bug 1350047	https://bugzilla.mozilla.org/show_bug.cgi?id=1350047
7	Bug 1352745	https://bugzilla.mozilla.org/show_bug.cgi?id=1352745
8	Bug 1352747	https://bugzilla.mozilla.org/show_bug.cgi?id=1352747
9	Bug 1355174	https://bugzilla.mozilla.org/show_bug.cgi?id=1355174
10	Bug 1355182	https://bugzilla.mozilla.org/show_bug.cgi?id=1355182
11	Bug 1356607	https://bugzilla.mozilla.org/show_bug.cgi?id=1356607
12	Bug 1358551	https://bugzilla.mozilla.org/show_bug.cgi?id=1358551
Mozilla Foundation Security Advisory
13	MFSA2017-15	https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/
14	MFSA2017-16	https://www.mozilla.org/en-US/security/advisories/mfsa2017-16/
15	MFSA2017-17	https://www.mozilla.org/en-US/security/advisories/mfsa2017-17/

Change Log

No	Changed Details	Date of change
1	[2018年08月28日] 掲載	Aug. 28, 2018, 5:17 p.m.