CVE-2017-5451

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event. The event could be used by script to affect text display to make the loaded site appear to be different from the one actually loaded within the addressbar. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published
Jun 11, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-54524.3Malicious sites can display a spoofed addressbar on a page when the existing location bar on the new page is scrolled out of view if an HTMLCVE-2017-54534.3A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed'sCVE-2017-54547.5A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in CVE-2017-54557.5The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege if combined with anoCVE-2017-54569.8A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This aCVE-2017-54586.1When a "javascript:" URL is drag and dropped by a user into the addressbar, the URL will be processed and executed. This allows for users toCVE-2017-54599.8A buffer overflow in WebGL triggerable by web content, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird CVE-2017-54609.8A use-after-free vulnerability in frame selection triggered by a combination of malicious script content and key presses by a user. This resCVE-2017-54619.8Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 aCVE-2017-54625.3A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bitsCVE-2017-54635.3Android intents can be used to launch Firefox for Android in reader mode with a user specified URL. This allows an attacker to spoof the conCVE-2017-54649.8During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading