A vulnerability while parsing "application/http-index-format" format content where uninitialized values are used to create an array. This could allow the reading of uninitialized memory into the arrays affected. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
| Link | Tags |
|---|---|
| https://access.redhat.com/errata/RHSA-2017:1106 | third party advisory vendor advisory |
| https://www.mozilla.org/security/advisories/mfsa2017-12/ | vendor advisory |
| https://www.mozilla.org/security/advisories/mfsa2017-11/ | vendor advisory |
| https://www.mozilla.org/security/advisories/mfsa2017-10/ | vendor advisory |
| http://www.securityfocus.com/bid/97940 | vdb entry third party advisory |
| https://www.debian.org/security/2017/dsa-3831 | third party advisory vendor advisory |
| https://www.mozilla.org/security/advisories/mfsa2017-13/ | vendor advisory |
| http://www.securitytracker.com/id/1038320 | vdb entry third party advisory |
| https://access.redhat.com/errata/RHSA-2017:1104 | third party advisory vendor advisory |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1344467 | issue tracking exploit vendor advisory |
| https://access.redhat.com/errata/RHSA-2017:1201 | third party advisory vendor advisory |