CVE-2017-5429

What it actually does

Multiple memory safety bugs resulting in memory corruption that can be leveraged for arbitrary code execution.

Why it matters to the business

Remote attackers could gain full control of affected user systems, enabling theft of credentials or data, deployment of malware, or persistence within the environment.

How an attack unfolds

An attacker supplies malicious web content or email that triggers one of the memory corruption conditions during parsing or rendering, bypassing memory protections to execute attacker-controlled code.

How to fix it

Upgrade Firefox to version 53 or later, Firefox ESR to 45.9 or 52.1 or later, and Thunderbird to 52.1 or later. Remove or isolate unsupported older releases.

How to confirm the fix worked

Query installed application versions via about:support or package manager and confirm they meet or exceed the fixed releases listed above.

Typical attack path

1. Serve or deliver malicious webpage or email to target
2. Trigger memory corruption via crafted input
3. Bypass ASLR or other mitigations
4. Execute arbitrary code and establish foothold

How to detect it

Search application crash logs and security event logs for repeated browser process terminations or unexpected child process spawns around the time of web or email activity on unpatched systems.

What your security team should do

• Immediately update all Firefox, Firefox ESR, and Thunderbird instances to the fixed versions
• Block or sandbox legacy browser instances until patched
• Review endpoint detection logs for post-exploitation artifacts from unpatched systems