CVE-2017-5428 Details
Description
An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the "createImageBitmap" API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer. This vulnerability affects Firefox ESR < 52.0.1 and Firefox < 52.0.1.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://rhn.redhat.com/errata/RHSA-2017-0558.html | CVE | Third Party Advisory |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1348168 | CVE | ExploitIssue TrackingPatchVendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2017-08/ | CVE | Vendor Advisory |
| http://www.securityfocus.com/bid/96959 | CVE | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1038060 | CVE | Third Party AdvisoryVDB Entry |
| http://rhn.redhat.com/errata/RHSA-2017-0558.html | [email protected] | Third Party Advisory |
| https://bugzilla.mozilla.org/show_bug.cgi?id=1348168 | [email protected] | ExploitIssue TrackingPatchVendor Advisory |
| https://www.mozilla.org/security/advisories/mfsa2017-08/ | [email protected] | Vendor Advisory |
| http://www.securityfocus.com/bid/96959 | [email protected] | Third Party AdvisoryVDB Entry |
| http://www.securitytracker.com/id/1038060 | [email protected] | Third Party AdvisoryVDB Entry |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| redhat enterprise linux | 7.0 |
CPE
Remediation
| |
| redhat enterprise linux desktop | 7.0 |
CPE
Remediation
| |
| redhat enterprise linux server | 7.0 |
CPE
Remediation
| |
| redhat enterprise linux server aus | 7.3 7.4 |
CPE
Remediation
| |
| redhat enterprise linux server eus | 7.3 7.4 7.5 |
CPE
Remediation
| |
| redhat enterprise linux workstation | 7.0 |
CPE
Remediation
| |
| mozilla firefox | < 52.0.1 |
CPE
Remediation
| |
| mozilla firefox esr | < 52.0.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Nov 21, 2024 | CVE Modified | CVE |
| May 14, 2024 | CVE Modified | [email protected] |
| Aug 9, 2018 | Initial Analysis | [email protected] |
| Jun 13, 2018 | CVE Modified | [email protected] |