CVE-2017-5421

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A malicious site could spoof the contents of the print preview window if popup windows are enabled, resulting in user confusion of what site is currently loaded. This vulnerability affects Firefox < 52 and Thunderbird < 52.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 52
Mozilla	Thunderbird	>= unspecified, < 52

References

http://www.securityfocus.com/bid/96692Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037966Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1301876Exploit, Issue Tracking, Patch, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-05/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-09/Vendor Advisory
http://www.securityfocus.com/bid/96692Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037966Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1301876Exploit, Issue Tracking, Patch, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-05/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-09/Vendor Advisory

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-54227.5If a malicious site uses the "view-source:" protocol in a series within a single hyperlink, it can trigger a non-exploitable browser crash w CVE-2017-54257.5The Gecko Media Plugin sandbox allows access to local files that match specific regular expressions. On OS OX, this matching allows access t CVE-2017-54265.3On Linux, if the secure computing mode BPF (seccomp-bpf) filter is running when the Gecko Media Plugin sandbox is started, the sandbox fails CVE-2017-54275.5A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. If a malicious user wi CVE-2017-54289.8An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimen CVE-2017-54299.8Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of CVE-2017-54309.8Memory safety bugs were reported in Firefox 52, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption CVE-2017-54329.8A use-after-free vulnerability occurs during certain text input selection resulting in a potentially exploitable crash. This vulnerability a CVE-2017-54339.8A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the anima CVE-2017-54349.8A use-after-free vulnerability occurs when redirecting focus handling which results in a potentially exploitable crash. This vulnerability a CVE-2017-54359.8A use-after-free vulnerability occurs during transaction processing in the editor during design mode interactions. This results in a potenti CVE-2017-54368.8An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitab