Arch Linux Security Advisory ASA-201703-15 ========================================== Severity: High Date : 2017-03-18 CVE-ID : CVE-2017-5428 Package : firefox Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-219 Summary ======= The package firefox before version 52.0.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 52.0.1-1. # pacman -Syu "firefox>=52.0.1-1" The problem has been fixed upstream in version 52.0.1. Workaround ========== None. Description =========== An integer overflow in createImageBitmap() was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the createImageBitmap API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer. Impact ====== A remote attacker might be able to execute arbitrary code on the affected host. References ========== https://www.mozilla.org/en-US/security/advisories/mfsa2017-08/#CVE-2017-5428 https://bugzilla.mozilla.org/show_bug.cgi?id=1348168 https://security.archlinux.org/CVE-2017-5428