CVE-2017-7758

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

An out-of-bounds read vulnerability with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.

Metrics

CVSS 3.0 9.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 54
Mozilla	Firefox ESR	>= unspecified, < 52.2
Mozilla	Thunderbird	>= unspecified, < 52.2

References

http://www.securityfocus.com/bid/99057Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038689Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:1440Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1561Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1368490Exploit, Issue Tracking, Patch
https://www.debian.org/security/2017/dsa-3881Third Party Advisory
https://www.debian.org/security/2017/dsa-3918Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2017-15/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-16/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-17/Vendor Advisory
http://www.securityfocus.com/bid/99057Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038689Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:1440Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1561Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1368490Exploit, Issue Tracking, Patch
https://www.debian.org/security/2017/dsa-3881Third Party Advisory
https://www.debian.org/security/2017/dsa-3918Third Party Advisory
https://www.mozilla.org/security/advisories/mfsa2017-15/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-16/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-17/Vendor Advisory

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-77597.5Android intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs to local "file:" URLs, allowing for the rea CVE-2017-77607.8The Mozilla Windows updater modifies some files to be updated by reading the original file and applying changes to it. The location of the o CVE-2017-77615.5The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users. When this is combin CVE-2017-77627.5When entered directly, Reader Mode did not strip the username and password section of URLs displayed in the addressbar. This can be used for CVE-2017-77635.3Default fonts on OS X display some Tibetan characters as whitespace. When used in the addressbar as part of an IDN this can be used for doma CVE-2017-77645.3Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of b CVE-2017-77657.5The "Mark of the Web" was not correctly saved on Windows when files with very long names were downloaded from the Internet. Without the Mark CVE-2017-77667.8An attack using manipulation of "updater.ini" contents, used by the Mozilla Windows Updater, and privilege escalation through the Mozilla Ma CVE-2017-77675.5The Mozilla Maintenance Service can be invoked by an unprivileged user to overwrite arbitrary files with junk data using the Mozilla Windows CVE-2017-77685.5The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the local system by convinc CVE-2017-77705.9A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar will not be rendere CVE-2017-77718.1Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Pass::readPass function.