VulnerableCode Vulnerability Details

Search for vulnerabilities

Vulnerability details: VCID-rb5k-j1nc-hyej

Essentials
Severities (26)
References (63)
Severity details (9)
Exploits (1)
EPSS
History (1)

Vulnerability ID	VCID-rb5k-j1nc-hyej
Aliases	CVE-2017-5375
Summary	JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks.
Status	Published
Exploitability	2.0
Weighted Severity	9.0
Risk	10.0
Affected and Fixed Packages	Package Details

Weaknesses (1)

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

System	Score	Found at
cvssv3	9.8	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-5375.json
epss	0.61559	https://api.first.org/data/v1/epss?cve=CVE-2017-5375
epss	0.61559	https://api.first.org/data/v1/epss?cve=CVE-2017-5375
epss	0.61559	https://api.first.org/data/v1/epss?cve=CVE-2017-5375
epss	0.61559	https://api.first.org/data/v1/epss?cve=CVE-2017-5375
epss	0.61559	https://api.first.org/data/v1/epss?cve=CVE-2017-5375
epss	0.61559	https://api.first.org/data/v1/epss?cve=CVE-2017-5375
epss	0.61559	https://api.first.org/data/v1/epss?cve=CVE-2017-5375
epss	0.61559	https://api.first.org/data/v1/epss?cve=CVE-2017-5375
epss	0.61559	https://api.first.org/data/v1/epss?cve=CVE-2017-5375
epss	0.61559	https://api.first.org/data/v1/epss?cve=CVE-2017-5375
epss	0.61559	https://api.first.org/data/v1/epss?cve=CVE-2017-5375
epss	0.61559	https://api.first.org/data/v1/epss?cve=CVE-2017-5375
epss	0.61729	https://api.first.org/data/v1/epss?cve=CVE-2017-5375
epss	0.61729	https://api.first.org/data/v1/epss?cve=CVE-2017-5375
epss	0.61729	https://api.first.org/data/v1/epss?cve=CVE-2017-5375
epss	0.61729	https://api.first.org/data/v1/epss?cve=CVE-2017-5375
epss	0.61729	https://api.first.org/data/v1/epss?cve=CVE-2017-5375
cvssv2	6.8	https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2	7.5	https://nvd.nist.gov/vuln/detail/CVE-2017-5375
cvssv3	9.8	https://nvd.nist.gov/vuln/detail/CVE-2017-5375
archlinux	Critical	https://security.archlinux.org/AVG-157
archlinux	Critical	https://security.archlinux.org/AVG-158
generic_textual	critical	https://www.mozilla.org/en-US/security/advisories/mfsa2017-01
generic_textual	critical	https://www.mozilla.org/en-US/security/advisories/mfsa2017-02
generic_textual	critical	https://www.mozilla.org/en-US/security/advisories/mfsa2017-03

Reference id	Reference type	URL
		http://rhn.redhat.com/errata/RHSA-2017-0190.html
		http://rhn.redhat.com/errata/RHSA-2017-0238.html
		https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-5375.json
		https://api.first.org/data/v1/epss?cve=CVE-2017-5375
		https://bugzilla.mozilla.org/show_bug.cgi?id=1325200
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5373
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5375
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5376
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5378
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5380
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5383
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5386
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5390
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5396
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5398
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5400
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5401
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5402
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5404
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5405
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5407
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5408
		https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5410
		https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
		https://security.gentoo.org/glsa/201702-13
		https://security.gentoo.org/glsa/201702-22
		https://www.debian.org/security/2017/dsa-3771
		https://www.debian.org/security/2017/dsa-3832
		https://www.exploit-db.com/exploits/44293/
		https://www.exploit-db.com/exploits/44294/
		https://www.mozilla.org/security/advisories/mfsa2017-01/
		https://www.mozilla.org/security/advisories/mfsa2017-02/
		https://www.mozilla.org/security/advisories/mfsa2017-03/
		http://www.securityfocus.com/bid/95757
		http://www.securitytracker.com/id/1037693
1416271		https://bugzilla.redhat.com/show_bug.cgi?id=1416271
ASA-201701-39		https://security.archlinux.org/ASA-201701-39
ASA-201701-40		https://security.archlinux.org/ASA-201701-40
AVG-157		https://security.archlinux.org/AVG-157
AVG-158		https://security.archlinux.org/AVG-158
cpe:2.3:a:mozilla:firefox::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox::::::::
cpe:2.3:a:mozilla:firefox_esr::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:firefox_esr::::::::
cpe:2.3:a:mozilla:thunderbird::::::::		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mozilla:thunderbird::::::::
cpe:2.3:o:debian:debian_linux:8.0:::::::*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:8.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:::::::*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:5.0:::::::*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:::::::*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*		https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
CVE-2017-5375		https://nvd.nist.gov/vuln/detail/CVE-2017-5375
CVE-2017-5375;CVE-2016-1960	Exploit	https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/remote/44294.html
CVE-2017-5375;CVE-2016-2819	Exploit	https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/remote/44293.html
mfsa2017-01		https://www.mozilla.org/en-US/security/advisories/mfsa2017-01
mfsa2017-02		https://www.mozilla.org/en-US/security/advisories/mfsa2017-02
mfsa2017-03		https://www.mozilla.org/en-US/security/advisories/mfsa2017-03
RHSA-2017:0190		https://access.redhat.com/errata/RHSA-2017:0190
RHSA-2017:0238		https://access.redhat.com/errata/RHSA-2017:0238
USN-3165-1		https://usn.ubuntu.com/3165-1/
USN-3175-1		https://usn.ubuntu.com/3175-1/

Data source	Exploit-DB
Date added	July 14, 2017
Description	Firefox 50.0.1 - ASM.JS JIT-Spray Remote Code Execution
Ransomware campaign use	Unknown
Source publication date	July 14, 2017
Exploit type	remote
Platform	windows
Source update date	July 14, 2017
Source URL	https://rh0dev.github.io/blog/2017/the-return-of-the-jit/

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-5375.json

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml

Exploitability (E)	Access Vector (AV)	Access Complexity (AC)	Authentication (Au)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
high functional unproven proof_of_concept not_defined	local adjacent_network network	high medium low	multiple single none	none partial complete	none partial complete	none partial complete

Exploitability (E)

Access Vector (AV)

Access Complexity (AC)

Authentication (Au)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

partial

complete

none

partial

complete

none

partial

complete

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2017-5375

Exploitability (E)	Access Vector (AV)	Access Complexity (AC)	Authentication (Au)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
high functional unproven proof_of_concept not_defined	local adjacent_network network	high medium low	multiple single none	none partial complete	none partial complete	none partial complete

Exploitability (E)

Access Vector (AV)

Access Complexity (AC)

Authentication (Au)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

partial

complete

none

partial

complete

none

partial

complete

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-5375

Attack Vector (AV)	Attack Complexity (AC)	Privileges Required (PR)	User Interaction (UI)	Scope (S)	Confidentiality Impact (C)	Integrity Impact (I)	Availability Impact (A)
network adjacent_network local physical	low high	none low high	none required	unchanged changed	high low none	high low none	high low none

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality Impact (C)

Integrity Impact (I)

Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

Exploit Prediction Scoring System (EPSS)

Percentile	0.9824
EPSS Score	0.61559
Published At	July 30, 2025, 12:55 p.m.

Date	Actor	Action	Source	VulnerableCode Version
2025-07-31T08:09:15.706626+00:00	Mozilla Importer	Import	https://github.com/mozilla/foundation-security-advisories/blob/master/announce/2017/mfsa2017-03.yml	37.0.0