CVE-2017-5426

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

On Linux, if the secure computing mode BPF (seccomp-bpf) filter is running when the Gecko Media Plugin sandbox is started, the sandbox fails to be applied and items that would run within the sandbox are run protected only by the running filter which is typically weak compared to the sandbox. Note: this issue only affects Linux. Other operating systems are not affected. This vulnerability affects Firefox < 52 and Thunderbird < 52.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
Mozilla	Firefox	>= unspecified, < 52
Mozilla	Thunderbird	>= unspecified, < 52

References

http://www.securityfocus.com/bid/96694Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037966Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1257361Issue Tracking, Patch, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-05/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-09/Vendor Advisory
http://www.securityfocus.com/bid/96694Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1037966Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1257361Issue Tracking, Patch, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-05/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-09/Vendor Advisory

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-54275.5A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. If a malicious user wi CVE-2017-54289.8An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimen CVE-2017-54299.8Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of CVE-2017-54309.8Memory safety bugs were reported in Firefox 52, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption CVE-2017-54329.8A use-after-free vulnerability occurs during certain text input selection resulting in a potentially exploitable crash. This vulnerability a CVE-2017-54339.8A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the anima CVE-2017-54349.8A use-after-free vulnerability occurs when redirecting focus handling which results in a potentially exploitable crash. This vulnerability a CVE-2017-54359.8A use-after-free vulnerability occurs during transaction processing in the editor during design mode interactions. This results in a potenti CVE-2017-54368.8An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitab CVE-2017-54389.8A use-after-free vulnerability during XSLT processing due to the result handler being held by a freed handler during handling. This results CVE-2017-54399.8A use-after-free vulnerability during XSLT processing due to poor handling of template parameters. This results in a potentially exploitable CVE-2017-54409.8A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating contex