CVE-2017-5429

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited to run arbitrary code. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

VendorProductVersions
MozillaThunderbird>= unspecified, < 52.1
MozillaFirefox ESR>= unspecified, < 45.9; >= unspecified, < 52.1
MozillaFirefox>= unspecified, < 53

References

Timeline

Published
Jun 11, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-54309.8Memory safety bugs were reported in Firefox 52, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption CVE-2017-54329.8A use-after-free vulnerability occurs during certain text input selection resulting in a potentially exploitable crash. This vulnerability aCVE-2017-54339.8A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the animaCVE-2017-54349.8A use-after-free vulnerability occurs when redirecting focus handling which results in a potentially exploitable crash. This vulnerability aCVE-2017-54359.8A use-after-free vulnerability occurs during transaction processing in the editor during design mode interactions. This results in a potentiCVE-2017-54368.8An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitabCVE-2017-54389.8A use-after-free vulnerability during XSLT processing due to the result handler being held by a freed handler during handling. This results CVE-2017-54399.8A use-after-free vulnerability during XSLT processing due to poor handling of template parameters. This results in a potentially exploitableCVE-2017-54409.8A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating contexCVE-2017-54419.8A use-after-free vulnerability when holding a selection during scroll events. This results in a potentially exploitable crash. This vulnerabCVE-2017-54429.8A use-after-free vulnerability during changes in style when manipulating DOM elements. This results in a potentially exploitable crash. ThisCVE-2017-54439.8An out-of-bounds write vulnerability while decoding improperly formed BinHex format archives. This vulnerability affects Thunderbird < 52.1,
CVE-2017-5429: Critical severity, CVSS 9.8 | Vulnix