CVE-2017-5410

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweeping is managed for memory cleanup. This vulnerability affects Firefox < 52, Firefox ESR < 45.8, Thunderbird < 52, and Thunderbird < 45.8.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

VendorProductVersions
MozillaFirefox>= unspecified, < 52
MozillaFirefox ESR>= unspecified, < 45.8
MozillaThunderbird>= unspecified, < 52; >= unspecified, < 45.8

References

Timeline

Published
Jun 11, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-54117.5A use-after-free can occur during buffer storage operations within the ANGLE graphics library, used for WebGL content. The buffer storage caCVE-2017-54127.5A buffer overflow read during SVG filter color value operations, resulting in data exposure. This vulnerability affects Firefox < 52 and ThuCVE-2017-54139.8A segmentation fault can occur during some bidirectional layout operations. This vulnerability affects Firefox < 52 and Thunderbird < 52.CVE-2017-54145.5The file picker dialog can choose and display the wrong local default directory when instantiated. On some operating systems, this can lead CVE-2017-54155.3An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leading to user confusion CVE-2017-54167.5In certain circumstances a networking event listener can be prematurely released. This appears to result in a null dereference in practice. CVE-2017-54175.3When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the addressbar so that tCVE-2017-54185.3An out of bounds read error occurs when parsing some HTTP digest authorization responses, resulting in information leakage through the readiCVE-2017-54197.5If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-responsive, requiring shutdCVE-2017-54206.5A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressbar, allowing for an aCVE-2017-54217.5A malicious site could spoof the contents of the print preview window if popup windows are enabled, resulting in user confusion of what siteCVE-2017-54227.5If a malicious site uses the "view-source:" protocol in a series within a single hyperlink, it can trigger a non-exploitable browser crash w
CVE-2017-5410: Critical severity, CVSS 9.8 | Vulnix