CVE-2017-5436
HighCVSS 8.8Exploitation Probability (EPSS)
High risk84th percentile - higher than 84% of all known CVEs
Summary
An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.
Risk Assessment
Opening a malicious page or message with a crafted Graphite font can crash the browser or mail client and potentially lead to code execution in the user's context.
Recommendation
Update Thunderbird and Firefox/Firefox ESR to versions newer than those listed as vulnerable, and update the Graphite 2 library to a patched version.
Other vulnerabilities in Graphite 2
Original NVD description (English source)
An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issue was fixed in the Graphite 2 library as well as Mozilla products. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS