« Volver al listado

CVE-2017-7813

Estado: ModificadaAlta (8.2)—

Dentro del analizador JavaScript, el retorno de un entero a un tipo más estrecho puede resultar en que los datos leídos desde fuera del búfer sean analizados. Esto generalmente resulta en un cierre inesperado no explotable, pero puede filtrar una cantidad limitada de información de la memoria si coincide con la sintaxis del identificador JavaScript. Esta vulnerabilidad afecta a las versiones anteriores a la 56 de Firefox.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Mozilla — Firefox

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-7813",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security@mozilla.org",
      "affectedData": [
        {
          "vendor": "Mozilla",
          "product": "Firefox",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "56",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-06-11T21:29:10.500",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/101057",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.securitytracker.com/id/1039465",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1383951",
      "tags": [
        "Exploit",
        "Issue Tracking"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "https://www.mozilla.org/security/advisories/mfsa2017-21/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@mozilla.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/101057",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1039465",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1383951",
      "tags": [
        "Exploit",
        "Issue Tracking"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.mozilla.org/security/advisories/mfsa2017-21/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-125"
        },
        {
          "lang": "en",
          "value": "CWE-704"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Inside the JavaScript parser, a cast of an integer to a narrower type can result in data read from outside the buffer being parsed. This usually results in a non-exploitable crash, but can leak a limited amount of information from memory if it matches JavaScript identifier syntax. This vulnerability affects Firefox < 56."
    },
    {
      "lang": "es",
      "value": "Dentro del analizador JavaScript, el retorno de un entero a un tipo más estrecho puede resultar en que los datos leídos desde fuera del búfer sean analizados. Esto generalmente resulta en un cierre inesperado no explotable, pero puede filtrar una cantidad limitada de información de la memoria si coincide con la sintaxis del identificador JavaScript. Esta vulnerabilidad afecta a las versiones anteriores a la 56 de Firefox."
    }
  ],
  "lastModified": "2026-06-17T01:25:15.897",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FEC7D85F-EE10-4144-B49D-DC88DE61352E",
              "versionEndIncluding": "55.0.3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@mozilla.org"
}