CVE-2017-5376

Use-after-free while manipulating XSL in XSLT documents

published June 11, 2018

CVSS
—
EPSS
3%
Percentile
87.7
In the wild
Unconfirmed
What it is

⚠️ A crafty use-after-free vulnerability just hanging out in XSLT documents could be your next headache! 🚨 Think of it like a restaurant where the chef accidentally leaves a dish unattended. If someone swoops in before it’s cleared away, they could snag a taste of something they shouldn’t! This vulnerability could lead to unexpected behavior in applications like Thunderbird and Firefox, potentially allowing an attacker to execute arbitrary code. It’s a sneaky little bug that could compromise users' data if they encounter malicious content!

Put simply

Think of it like a restaurant where the chef accidentally leaves a dish unattended. If someone swoops in before it’s cleared away, they could snag a taste of something they shouldn’t! The vulnerability arises from improper handling of memory when manipulating XSL in XSLT documents, leading to a use-after-free scenario where freed memory can be accessed again.

What to do

This vulnerability could lead to unexpected behavior in applications like Thunderbird and Firefox, potentially allowing an attacker to execute arbitrary code. It’s a sneaky little bug that could compromise users' data if they encounter malicious content! To safeguard your applications, ensure Thunderbird is updated to version 45.7 or later, and Firefox to version 51 or later. Regularly check for updates and apply them promptly to keep your systems secure! You’ve got this! Patch those applications and reclaim your peace of mind! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03129 · 87.7th percentile
Published
2018-06-11T21:00Z
EPSS history
Timeline
  • 11 JUN 21:00Z
    Use-after-free while manipulating XSL in XSLT documents
    cvelistv5