CVE-2017-5427

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. If a malicious user with local access puts chrome.manifest and other referenced files in this directory, they will be loaded and activated during startup. This could result in malicious software being added without consent or modification of referenced installed files. This vulnerability affects Firefox < 52.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published
Jun 11, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-54289.8An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimenCVE-2017-54299.8Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of CVE-2017-54309.8Memory safety bugs were reported in Firefox 52, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption CVE-2017-54329.8A use-after-free vulnerability occurs during certain text input selection resulting in a potentially exploitable crash. This vulnerability aCVE-2017-54339.8A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the animaCVE-2017-54349.8A use-after-free vulnerability occurs when redirecting focus handling which results in a potentially exploitable crash. This vulnerability aCVE-2017-54359.8A use-after-free vulnerability occurs during transaction processing in the editor during design mode interactions. This results in a potentiCVE-2017-54368.8An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitabCVE-2017-54389.8A use-after-free vulnerability during XSLT processing due to the result handler being held by a freed handler during handling. This results CVE-2017-54399.8A use-after-free vulnerability during XSLT processing due to poor handling of template parameters. This results in a potentially exploitableCVE-2017-54409.8A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating contexCVE-2017-54419.8A use-after-free vulnerability when holding a selection during scroll events. This results in a potentially exploitable crash. This vulnerab
CVE-2017-5427: Medium severity, CVSS 5.5 | Vulnix