VulnerableCode Package Details - pkg:alpm/archlinux/thunderbird@52.2.0-1

Search for packages

Vulnerability	Summary	Fixed by
This package is not known to be affected by vulnerabilities.

Vulnerability

Summary

Fixed by

This package is not known to be affected by vulnerabilities.

Vulnerability	Summary	Aliases
VCID-2krw-arzc-83bf	An out-of-bounds read vulnerability with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use.	CVE-2017-7758
VCID-347w-5rsv-tugs	Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54 in lz4::decompress src/Decompressor.	CVE-2017-7773
VCID-3cp3-cxzm-17bt	Heap-based Buffer Overflow read in Graphite2 library in Firefox before 54 in graphite2::Silf::getClassGlyph.	CVE-2017-7776
VCID-4u3g-ucaz-pkfd	Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function.	CVE-2017-7777
VCID-ankv-q2f6-3fe2	Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none	CVE-2017-7775
VCID-cfr5-npdq-j3fm	Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Pass::readPass function.	CVE-2017-7771
VCID-h7t9-j2ty-vqfh	A use-after-free vulnerability during video control operations when a <track> element holds a reference to an older window if that window has been replaced in the DOM. This results in a potentially exploitable crash.	CVE-2017-7750
VCID-hhan-628q-tqbb	A use-after-free and use-after-scope vulnerability when logging errors from headers for XML HTTP Requests (XHR). This could result in a potentially exploitable crash.	CVE-2017-7756
VCID-hue9-wr9c-3yfw	A use-after-free vulnerability during specific user interactions with the input method editor (IME) in some languages due to how events are handled. This results in a potentially exploitable crash but would require specific user interaction to trigger.	CVE-2017-7752
VCID-kxzj-2jys-ubc5	A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This results in a potentially exploitable crash.	CVE-2017-7749
VCID-m5ne-1n7g-8ka3	Heap-based Buffer Overflow in Graphite2 library in Firefox before 54 in lz4::decompress function.	CVE-2017-7772
VCID-mbbs-34nc-gyb4	A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2 version 1.3.10.	CVE-2017-7778
VCID-pda8-gnfv-5qa5	A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS layout when attempting to use a node in the tree that no longer exists. This results in a potentially exploitable crash.	CVE-2017-5472
VCID-ptfw-t9ej-z7b7	A use-after-free vulnerability with content viewer listeners that results in a potentially exploitable crash.	CVE-2017-7751
VCID-raem-kwtm-t7e7	An out-of-bounds read in WebGL with a maliciously crafted ImageInfo object during WebGL operations.	CVE-2017-7754
VCID-rj6f-fqqu-73gs	A use-after-free vulnerability in IndexedDB when one of its objects is destroyed in memory while a method on it is still being executed. This results in a potentially exploitable crash.	CVE-2017-7757
VCID-stvs-mzq6-27ef	Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Silf::readGraphite function.	CVE-2017-7774
VCID-sy78-y9qc-3ug1	Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of being rendered as their raw "punycode" form, allowing for domain name spoofing attacks through character confusion. The current Unicode standard allows characters from "Aspirational Use Scripts" such as Canadian Syllabics to be mixed with Latin characters in the "moderately restrictive" IDN profile. We have changed Firefox behavior to match the upcoming Unicode version 10.0 which removes this category and treats them as "Limited Use Scripts."	CVE-2017-7764
VCID-yj1m-aufw-yuct	Mozilla developers and community members Tyson Smith, Mats Palmgren, Philipp, Masayuki Nakano, Christian Holler, Andrew McCreight, Gary Kwong, André Bargull, Carsten Book, Jesse Schwartzentruber, Julian Hector, Marcia Knous, Ronald Crane, and Nils Ohlmeier reported memory safety bugs present in Firefox 53, Firefox ESR 52.1, and Thunderbird 52.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.	CVE-2017-5470

Vulnerability

Summary

Aliases

VCID-2krw-arzc-83bf

An out-of-bounds read vulnerability with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use.

CVE-2017-7758

VCID-347w-5rsv-tugs

Heap-based Buffer Overflow write in Graphite2 library in Firefox before 54 in lz4::decompress src/Decompressor.

CVE-2017-7773

VCID-3cp3-cxzm-17bt

Heap-based Buffer Overflow read in Graphite2 library in Firefox before 54 in graphite2::Silf::getClassGlyph.

CVE-2017-7776

VCID-4u3g-ucaz-pkfd

Use of uninitialized memory in Graphite2 library in Firefox before 54 in graphite2::GlyphCache::Loader::read_glyph function.

CVE-2017-7777

VCID-ankv-q2f6-3fe2

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none

CVE-2017-7775

VCID-cfr5-npdq-j3fm

Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Pass::readPass function.

CVE-2017-7771

VCID-h7t9-j2ty-vqfh

A use-after-free vulnerability during video control operations when a <track> element holds a reference to an older window if that window has been replaced in the DOM. This results in a potentially exploitable crash.

CVE-2017-7750

VCID-hhan-628q-tqbb

A use-after-free and use-after-scope vulnerability when logging errors from headers for XML HTTP Requests (XHR). This could result in a potentially exploitable crash.

CVE-2017-7756

VCID-hue9-wr9c-3yfw

A use-after-free vulnerability during specific user interactions with the input method editor (IME) in some languages due to how events are handled. This results in a potentially exploitable crash but would require specific user interaction to trigger.

CVE-2017-7752

VCID-kxzj-2jys-ubc5

A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This results in a potentially exploitable crash.

CVE-2017-7749

VCID-m5ne-1n7g-8ka3

Heap-based Buffer Overflow in Graphite2 library in Firefox before 54 in lz4::decompress function.

CVE-2017-7772

VCID-mbbs-34nc-gyb4

A number of security vulnerabilities in the Graphite 2 library including out-of-bounds reads, buffer overflow reads and writes, and the use of uninitialized memory. These issues were addressed in Graphite 2 version 1.3.10.

CVE-2017-7778

VCID-pda8-gnfv-5qa5

A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS layout when attempting to use a node in the tree that no longer exists. This results in a potentially exploitable crash.

CVE-2017-5472

VCID-ptfw-t9ej-z7b7

A use-after-free vulnerability with content viewer listeners that results in a potentially exploitable crash.

CVE-2017-7751

VCID-raem-kwtm-t7e7

An out-of-bounds read in WebGL with a maliciously crafted ImageInfo object during WebGL operations.

CVE-2017-7754

VCID-rj6f-fqqu-73gs

A use-after-free vulnerability in IndexedDB when one of its objects is destroyed in memory while a method on it is still being executed. This results in a potentially exploitable crash.

CVE-2017-7757

VCID-stvs-mzq6-27ef

Out-of-bounds read in Graphite2 Library in Firefox before 54 in graphite2::Silf::readGraphite function.

CVE-2017-7774

VCID-sy78-y9qc-3ug1

Characters from the "Canadian Syllabics" unicode block can be mixed with characters from other unicode blocks in the addressbar instead of being rendered as their raw "punycode" form, allowing for domain name spoofing attacks through character confusion. The current Unicode standard allows characters from "Aspirational Use Scripts" such as Canadian Syllabics to be mixed with Latin characters in the "moderately restrictive" IDN profile. We have changed Firefox behavior to match the upcoming Unicode version 10.0 which removes this category and treats them as "Limited Use Scripts."

CVE-2017-7764

VCID-yj1m-aufw-yuct

Mozilla developers and community members Tyson Smith, Mats Palmgren, Philipp, Masayuki Nakano, Christian Holler, Andrew McCreight, Gary Kwong, André Bargull, Carsten Book, Jesse Schwartzentruber, Julian Hector, Marcia Knous, Ronald Crane, and Nils Ohlmeier reported memory safety bugs present in Firefox 53, Firefox ESR 52.1, and Thunderbird 52.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code.

CVE-2017-5470

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2025-07-31T11:35:36.686290+00:00	Arch Linux Importer	Fixing	VCID-yj1m-aufw-yuct	https://security.archlinux.org/AVG-303	37.0.0
2025-07-31T11:35:36.658746+00:00	Arch Linux Importer	Fixing	VCID-pda8-gnfv-5qa5	https://security.archlinux.org/AVG-303	37.0.0
2025-07-31T11:35:36.631623+00:00	Arch Linux Importer	Fixing	VCID-kxzj-2jys-ubc5	https://security.archlinux.org/AVG-303	37.0.0
2025-07-31T11:35:36.604754+00:00	Arch Linux Importer	Fixing	VCID-h7t9-j2ty-vqfh	https://security.archlinux.org/AVG-303	37.0.0
2025-07-31T11:35:36.577517+00:00	Arch Linux Importer	Fixing	VCID-ptfw-t9ej-z7b7	https://security.archlinux.org/AVG-303	37.0.0
2025-07-31T11:35:36.549503+00:00	Arch Linux Importer	Fixing	VCID-hue9-wr9c-3yfw	https://security.archlinux.org/AVG-303	37.0.0
2025-07-31T11:35:36.521407+00:00	Arch Linux Importer	Fixing	VCID-raem-kwtm-t7e7	https://security.archlinux.org/AVG-303	37.0.0
2025-07-31T11:35:36.492670+00:00	Arch Linux Importer	Fixing	VCID-hhan-628q-tqbb	https://security.archlinux.org/AVG-303	37.0.0
2025-07-31T11:35:36.464162+00:00	Arch Linux Importer	Fixing	VCID-rj6f-fqqu-73gs	https://security.archlinux.org/AVG-303	37.0.0
2025-07-31T11:35:36.435833+00:00	Arch Linux Importer	Fixing	VCID-2krw-arzc-83bf	https://security.archlinux.org/AVG-303	37.0.0
2025-07-31T11:35:36.407614+00:00	Arch Linux Importer	Fixing	VCID-sy78-y9qc-3ug1	https://security.archlinux.org/AVG-303	37.0.0
2025-07-31T11:35:36.379050+00:00	Arch Linux Importer	Fixing	VCID-cfr5-npdq-j3fm	https://security.archlinux.org/AVG-303	37.0.0
2025-07-31T11:35:36.349089+00:00	Arch Linux Importer	Fixing	VCID-m5ne-1n7g-8ka3	https://security.archlinux.org/AVG-303	37.0.0
2025-07-31T11:35:36.317889+00:00	Arch Linux Importer	Fixing	VCID-347w-5rsv-tugs	https://security.archlinux.org/AVG-303	37.0.0
2025-07-31T11:35:36.288574+00:00	Arch Linux Importer	Fixing	VCID-stvs-mzq6-27ef	https://security.archlinux.org/AVG-303	37.0.0
2025-07-31T11:35:36.259256+00:00	Arch Linux Importer	Fixing	VCID-ankv-q2f6-3fe2	https://security.archlinux.org/AVG-303	37.0.0
2025-07-31T11:35:36.227480+00:00	Arch Linux Importer	Fixing	VCID-3cp3-cxzm-17bt	https://security.archlinux.org/AVG-303	37.0.0
2025-07-31T11:35:36.186448+00:00	Arch Linux Importer	Fixing	VCID-4u3g-ucaz-pkfd	https://security.archlinux.org/AVG-303	37.0.0
2025-07-31T11:35:36.158405+00:00	Arch Linux Importer	Fixing	VCID-mbbs-34nc-gyb4	https://security.archlinux.org/AVG-303	37.0.0

2025-07-31T11:35:36.686290+00:00

Arch Linux Importer

Fixing