CVE-2017-5377

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A memory corruption vulnerability in Skia that can occur when using transforms to make gradients, resulting in a potentially exploitable crash. This vulnerability affects Firefox < 51.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 51

References

http://www.securityfocus.com/bid/95761Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037693Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1306883Issue Tracking, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-01/Vendor Advisory
http://www.securityfocus.com/bid/95761Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037693Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1306883Issue Tracking, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-01/Vendor Advisory

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-53787.5Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address can be discovered thr CVE-2017-53797.5Use-after-free vulnerability in Web Animations when interacting with cycle collection found through fuzzing. This vulnerability affects Fire CVE-2017-53809.8A potential use-after-free found through fuzzing during DOM manipulation of SVG content. This vulnerability affects Thunderbird < 45.7, Fire CVE-2017-53817.5The "export" function in the Certificate Viewer can force local filesystem navigation when the "common name" in a certificate contains slash CVE-2017-53827.5Feed preview for RSS feeds can be used to capture errors and exceptions generated by privileged content, allowing for the exposure of intern CVE-2017-53835.3URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name CVE-2017-53845.9Proxy Auto-Config (PAC) files can specify a JavaScript function called for all URL requests with the full URL path which exposes more inform CVE-2017-53857.5Data sent with in multipart channels, such as the multipart/x-mixed-replace MIME type, will ignore the referrer-policy response header, lead CVE-2017-53867.3WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential d CVE-2017-53873.3The existence of a specifically requested local file can be found due to the double firing of the "onerror" when the "source" attribute on a CVE-2017-53887.5A STUN server in conjunction with a large number of "webkitRTCPeerConnection" objects can be used to send large STUN packets in a short peri CVE-2017-53896.1WebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the appropriate permissions and then using host