CVE-2017-7813

Description

Inside the JavaScript parser, a cast of an integer to a narrower type can result in data read from outside the buffer being parsed. This usually results in a non-exploitable crash, but can leak a limited amount of information from memory if it matches JavaScript identifier syntax. This vulnerability affects Firefox < 56.

Weakness classification

• CWE-125: Out-of-bounds Read
• CWE-704: Incorrect Type Conversion or Cast

Primary references

• security@mozilla.org — Third Party Advisory, VDB Entry
• security@mozilla.org — Third Party Advisory, VDB Entry
• security@mozilla.org — Exploit, Issue Tracking
• security@mozilla.org — Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking
• af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory