CVE-2017-5402

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A use-after-free can occur when events are fired for a "FontFace" object after the object has been already been destroyed while working with fonts. This results in a potentially exploitable crash. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Jun 11, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-54039.8When adding a range to an object in the DOM, it is possible to use "addRange" to add the range to an incorrect root object. This triggers a CVE-2017-54049.8A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside ofCVE-2017-54055.3Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations. This vulnerability affeCVE-2017-54067.5A segmentation fault can occur in the Skia graphics library during some canvas operations due to issues with mask/clip intersection and emptCVE-2017-54076.5Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a taCVE-2017-54085.3Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading tCVE-2017-54095.5The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callbaCVE-2017-54109.8Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweepinCVE-2017-54117.5A use-after-free can occur during buffer storage operations within the ANGLE graphics library, used for WebGL content. The buffer storage caCVE-2017-54127.5A buffer overflow read during SVG filter color value operations, resulting in data exposure. This vulnerability affects Firefox < 52 and ThuCVE-2017-54139.8A segmentation fault can occur during some bidirectional layout operations. This vulnerability affects Firefox < 52 and Thunderbird < 52.CVE-2017-54145.5The file picker dialog can choose and display the wrong local default directory when instantiated. On some operating systems, this can lead