PublicDateAtUSN: 2017-06-14
Candidate: CVE-2017-7773
PublicDate: 2019-04-15 12:31:00 UTC
References: 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7773
 https://www.mozilla.org/en-US/security/advisories/mfsa2017-15/
 https://ubuntu.com/security/notices/USN-3315-1
 https://ubuntu.com/security/notices/USN-3321-1
 https://ubuntu.com/security/notices/USN-3398-1
Description:
 Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54
 in lz4::decompress src/Decompressor.
Ubuntu-Description: 
Notes: 
Bugs: 
Priority: medium
Discovered-by:
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H [8.8 HIGH]

Patches_graphite2:
upstream_graphite2: released (1.3.10)
precise/esm_graphite2: DNE
trusty_graphite2: released (1.3.10-0ubuntu0.14.04.1)
trusty/esm_graphite2: released (1.3.10-0ubuntu0.14.04.1)
vivid/ubuntu-core_graphite2: DNE
vivid/stable-phone-overlay_graphite2: ignored (reached end-of-life)
xenial_graphite2: released (1.3.10-0ubuntu0.16.04.1)
esm-infra/xenial_graphite2: released (1.3.10-0ubuntu0.16.04.1)
yakkety_graphite2: ignored (reached end-of-life)
zesty_graphite2: released (1.3.10-0ubuntu0.17.04.1)
devel_graphite2: not-affected (1.3.10-2)

Patches_firefox: 
upstream_firefox: released (54.0)
precise/esm_firefox: DNE
trusty_firefox: released (54.0+build3-0ubuntu0.14.04.1)
trusty/esm_firefox: DNE (trusty was released [54.0+build3-0ubuntu0.14.04.1])
vivid/ubuntu-core_firefox: DNE
vivid/stable-phone-overlay_firefox: DNE
xenial_firefox: released (54.0+build3-0ubuntu0.16.04.1)
esm-infra/xenial_firefox: released (54.0+build3-0ubuntu0.16.04.1)
yakkety_firefox: released (54.0+build3-0ubuntu0.16.10.1)
zesty_firefox: released (54.0+build3-0ubuntu0.17.04.1)
devel_firefox: released (54.0+build3-0ubuntu1)

Patches_thunderbird:
upstream_thunderbird: released (52.2.0)
precise/esm_thunderbird: DNE
trusty_thunderbird: released (1:52.2.1+build1-0ubuntu0.14.04.1)
trusty/esm_thunderbird: DNE (trusty was released [1:52.2.1+build1-0ubuntu0.14.04.1])
vivid/ubuntu-core_thunderbird: DNE
vivid/stable-phone-overlay_thunderbird: DNE
xenial_thunderbird: released (1:52.2.1+build1-0ubuntu0.16.04.1)
esm-infra/xenial_thunderbird: released (1:52.2.1+build1-0ubuntu0.16.04.1)
yakkety_thunderbird: released (1:52.2.1+build1-0ubuntu0.16.10.1)
zesty_thunderbird: released (1:52.2.1+build1-0ubuntu0.17.04.1)
devel_thunderbird: released (1:52.2.1+build1-0ubuntu1)