CVE-2017-5415

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leading to user confusion and further spoofing attacks. This vulnerability affects Firefox < 52.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Jun 11, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-54167.5In certain circumstances a networking event listener can be prematurely released. This appears to result in a null dereference in practice. CVE-2017-54175.3When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the addressbar so that tCVE-2017-54185.3An out of bounds read error occurs when parsing some HTTP digest authorization responses, resulting in information leakage through the readiCVE-2017-54197.5If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-responsive, requiring shutdCVE-2017-54206.5A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressbar, allowing for an aCVE-2017-54217.5A malicious site could spoof the contents of the print preview window if popup windows are enabled, resulting in user confusion of what siteCVE-2017-54227.5If a malicious site uses the "view-source:" protocol in a series within a single hyperlink, it can trigger a non-exploitable browser crash wCVE-2017-54257.5The Gecko Media Plugin sandbox allows access to local files that match specific regular expressions. On OS OX, this matching allows access tCVE-2017-54265.3On Linux, if the secure computing mode BPF (seccomp-bpf) filter is running when the Gecko Media Plugin sandbox is started, the sandbox failsCVE-2017-54275.5A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. If a malicious user wiCVE-2017-54289.8An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimenCVE-2017-54299.8Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of
CVE-2017-5415: Medium severity, CVSS 5.3 | Vulnix