CVE-2017-7778

Name of the Vulnerable Software and Affected Versions: Graphite 2 versions prior to 1.3.10 Mozilla Firefox versions prior to 54 Mozilla Firefox ESR versions prior to 52.2 Thunderbird versions prior to 52.2

Description: The issue is related to the lz4::decompress function in the Graphite 2 library, which is used by Mozilla Firefox and Mozilla Firefox ESR. It involves an out-of-bounds buffer write in memory. Exploitation of this issue can allow a remote attacker to execute arbitrary code or cause a denial of service. Additionally, there are other security issues in the Graphite 2 library, including out-of-bounds reads, buffer overflow reads and writes, and the use of uninitialized memory.

Recommendations: For Graphite 2 versions prior to 1.3.10, update to version 1.3.10 or later. For Mozilla Firefox versions prior to 54, update to version 54 or later. For Mozilla Firefox ESR versions prior to 52.2, update to version 52.2 or later. For Thunderbird versions prior to 52.2, update to version 52.2 or later.