CVE-2017-5451

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event. The event could be used by script to affect text display to make the loaded site appear to be different from the one actually loaded within the addressbar. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 52.1, and Firefox < 53.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Mozilla	Thunderbird	>= unspecified, < 52.1
Mozilla	Firefox ESR	>= unspecified, < 52.1
Mozilla	Firefox	>= unspecified, < 53

References

http://www.securityfocus.com/bid/97940Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038320Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:1106Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1201Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1273537Exploit, Issue Tracking, Patch, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-10/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-12/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-13/Vendor Advisory
http://www.securityfocus.com/bid/97940Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038320Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:1106Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1201Third Party Advisory
https://bugzilla.mozilla.org/show_bug.cgi?id=1273537Exploit, Issue Tracking, Patch, Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-10/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-12/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-13/Vendor Advisory

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-54524.3Malicious sites can display a spoofed addressbar on a page when the existing location bar on the new page is scrolled out of view if an HTML CVE-2017-54534.3A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed's CVE-2017-54547.5A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in CVE-2017-54557.5The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege if combined with ano CVE-2017-54569.8A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This a CVE-2017-54586.1When a "javascript:" URL is drag and dropped by a user into the addressbar, the URL will be processed and executed. This allows for users to CVE-2017-54599.8A buffer overflow in WebGL triggerable by web content, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird CVE-2017-54609.8A use-after-free vulnerability in frame selection triggered by a combination of malicious script content and key presses by a user. This res CVE-2017-54619.8Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 a CVE-2017-54625.3A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits CVE-2017-54635.3Android intents can be used to launch Firefox for Android in reader mode with a user specified URL. This allows an attacker to spoof the con CVE-2017-54649.8During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading