CVE-2017-5375 — Mozilla: Excessive JIT code allocation allows bypass of ASLR and DEP (MFSA 2017-02)

Back Back to CVE browser

CRITICAL

Mozilla: Excessive JIT code allocation allows bypass of ASLR and DEP (MFSA 2017-02)

Published Jun 11, 2018

9.8

CRITICAL

CVSS 3.0

EPSS 33.77%

Description

JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51.

Affected products

Vendor Mozilla Product Firefox Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <51
Vendor Mozilla Product Firefox ESR Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <45.7
Vendor Mozilla Product Thunderbird Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <45.7

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Mozilla

Firefox

n/a

Version	Status	Constraints
unspecified	affected	<51

Mozilla

Firefox ESR

n/a

Version	Status	Constraints
unspecified	affected	<45.7

Mozilla

Thunderbird

n/a

Version	Status	Constraints
unspecified	affected	<45.7

Red Hat Enterprise Linux 5

firefox-0:45.7.0-2.el5_11

Fixed · RHSA-2017:0190
Red Hat Enterprise Linux 5

thunderbird-0:45.7.0-1.el5_11

Fixed · RHSA-2017:0238
Red Hat Enterprise Linux 6

firefox-0:45.7.0-2.el6_8

Fixed · RHSA-2017:0190
Red Hat Enterprise Linux 6

thunderbird-0:45.7.0-1.el6_8

Fixed · RHSA-2017:0238
Red Hat Enterprise Linux 7

firefox-0:45.7.0-2.el7_3

Fixed · RHSA-2017:0190
Red Hat Enterprise Linux 7

thunderbird-0:45.7.0-1.el7_3

Fixed · RHSA-2017:0238

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	firefox-0:45.7.0-2.el5_11	Fixed	RHSA-2017:0190
Red Hat Enterprise Linux 5	thunderbird-0:45.7.0-1.el5_11	Fixed	RHSA-2017:0238
Red Hat Enterprise Linux 6	firefox-0:45.7.0-2.el6_8	Fixed	RHSA-2017:0190
Red Hat Enterprise Linux 6	thunderbird-0:45.7.0-1.el6_8	Fixed	RHSA-2017:0238
Red Hat Enterprise Linux 7	firefox-0:45.7.0-2.el7_3	Fixed	RHSA-2017:0190
Red Hat Enterprise Linux 7	thunderbird-0:45.7.0-1.el7_3	Fixed	RHSA-2017:0238

Remediation

No remediation recorded yet.

Metrics

33.77% 0.33771

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.33771

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (29 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	33.77% (0.33771)	98.34th	v5 (v2026.06.15)
Sep 22, 2026	33.77% (0.33771)	98.32th	v5 (v2026.06.15)
Sep 21, 2026	19.80% (0.19803)	97.34th	v5 (v2026.06.15)
Sep 6, 2026	33.77% (0.33771)	98.28th	v5 (v2026.06.15)
Sep 5, 2026	19.80% (0.19803)	97.29th	v5 (v2026.06.15)
Aug 30, 2026	33.77% (0.33771)	98.27th	v5 (v2026.06.15)
Aug 28, 2026	19.65% (0.19651)	97.25th	v5 (v2026.06.15)
Aug 24, 2026	33.53% (0.33534)	98.25th	v5 (v2026.06.15)
Aug 23, 2026	19.65% (0.19651)	97.25th	v5 (v2026.06.15)
Jun 15, 2026	33.43% (0.33434)	98.15th	v5 (v2026.06.15)
May 27, 2026	58.39% (0.58393)	98.23th	v4 (v2025.03.14)
Nov 21, 2025	61.73% (0.61729)	98.23th	v4 (v2025.03.14)
Nov 18, 2025	80.94% (0.80943)	99.23th	v4 (v2025.03.14)
May 30, 2025	61.56% (0.61559)	98.20th	v4 (v2025.03.14)
Mar 30, 2025	59.56% (0.59564)	98.07th	v4 (v2025.03.14)
Mar 29, 2025	70.21% (0.70208)	98.20th	v4 (v2025.03.14)
Mar 17, 2025	59.94% (0.59939)	98.06th	v4 (v2025.03.14)
Dec 17, 2024	91.32% (0.91324)	99.13th	v3 (v2023.03.01)
Sep 14, 2024	92.42% (0.92415)	99.06th	v3 (v2023.03.01)
Nov 2, 2023	93.46% (0.93458)	98.82th	v3 (v2023.03.01)
Jun 5, 2023	94.26% (0.94256)	98.77th	v3 (v2023.03.01)
Mar 7, 2023	94.62% (0.94618)	98.71th	v3 (v2023.03.01)
Mar 6, 2023	2.69% (0.02686)	82.85th	v2 (v2022.01.01)
Apr 1, 2022	2.69% (0.02686)	81.17th	v2 (v2022.01.01)
Feb 4, 2022	2.69% (0.02686)	62.66th	v2 (v2022.01.01)
Feb 3, 2022	11.05% (0.11046)	88.01th	v1
Jan 6, 2022	11.05% (0.11046)	87.86th	v1
Sep 1, 2021	11.05% (0.11046)	95.29th	v1
Apr 14, 2021	11.05% (0.11046)	0.00th	v1

Weaknesses (1)

CWE-119

Buffer Overflow

References (20)

http://rhn.redhat.com/errata/RHSA-2017-0190.html
vendor-advisoryx_refsource_REDHATThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0238.html
vendor-advisoryx_refsource_REDHATThird Party Advisory
http://www.securityfocus.com/bid/95757
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1037693
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2017-5375
Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1325200
x_refsource_CONFIRMIssue TrackingPermissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=1416271
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-5375
https://security.gentoo.org/glsa/201702-13
vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://security.gentoo.org/glsa/201702-22
vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2017-5375
https://www.debian.org/security/2017/dsa-3771
vendor-advisoryx_refsource_DEBIANThird Party Advisory
https://www.debian.org/security/2017/dsa-3832
vendor-advisoryx_refsource_DEBIANThird Party Advisory
https://www.exploit-db.com/exploits/42327/
exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/44293/
exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/44294/
exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry
https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/#CVE-2017-5375
https://www.mozilla.org/security/advisories/mfsa2017-01/
x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-02/
x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-03/
x_refsource_CONFIRMVendor Advisory

Link	Providers	Tags
http://rhn.redhat.com/errata/RHSA-2017-0190.html		vendor-advisoryx_refsource_REDHATThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0238.html		vendor-advisoryx_refsource_REDHATThird Party Advisory
http://www.securityfocus.com/bid/95757		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1037693		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
https://access.redhat.com/security/cve/CVE-2017-5375		Vendor Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1325200		x_refsource_CONFIRMIssue TrackingPermissions Required
https://bugzilla.redhat.com/show_bug.cgi?id=1416271		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-5375
https://security.gentoo.org/glsa/201702-13		vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://security.gentoo.org/glsa/201702-22		vendor-advisoryx_refsource_GENTOOThird Party Advisory
https://www.cve.org/CVERecord?id=CVE-2017-5375
https://www.debian.org/security/2017/dsa-3771		vendor-advisoryx_refsource_DEBIANThird Party Advisory
https://www.debian.org/security/2017/dsa-3832		vendor-advisoryx_refsource_DEBIANThird Party Advisory
https://www.exploit-db.com/exploits/42327/		exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/44293/		exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry
https://www.exploit-db.com/exploits/44294/		exploitx_refsource_EXPLOIT-DBThird Party AdvisoryVDB Entry
https://www.mozilla.org/en-US/security/advisories/mfsa2017-02/#CVE-2017-5375
https://www.mozilla.org/security/advisories/mfsa2017-01/		x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-02/		x_refsource_CONFIRMVendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-03/		x_refsource_CONFIRMVendor Advisory