CVE-2017-5458

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

When a "javascript:" URL is drag and dropped by a user into the addressbar, the URL will be processed and executed. This allows for users to be socially engineered to execute an XSS attack on themselves. This vulnerability affects Firefox < 53.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-54599.8A buffer overflow in WebGL triggerable by web content, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird CVE-2017-54609.8A use-after-free vulnerability in frame selection triggered by a combination of malicious script content and key presses by a user. This res CVE-2017-54619.8Mozilla Network Security Services (NSS) before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 a CVE-2017-54625.3A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits CVE-2017-54635.3Android intents can be used to launch Firefox for Android in reader mode with a user specified URL. This allows an attacker to spoof the con CVE-2017-54649.8During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading CVE-2017-54659.1An out-of-bounds read while processing SVG content in "ConvolvePixel". This results in a crash and also allows for otherwise inaccessible me CVE-2017-54666.1If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will ru CVE-2017-54677.5A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping region. This vulner CVE-2017-54689.1An issue with incorrect ownership model of "privateBrowsing" information exposed through developer tools. This can result in a non-exploitab CVE-2017-54699.8Fixed potential buffer overflows in generated Firefox code due to CVE-2016-6354 issue in Flex. This vulnerability affects Thunderbird < 52.1 CVE-2017-54709.8Memory safety bugs were reported in Firefox 53 and Firefox ESR 52.1. Some of these bugs showed evidence of memory corruption and we presume