CVE-2017-5464

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

During DOM manipulations of the accessibility tree through script, the DOM tree can become out of sync with the accessibility tree, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9, Firefox ESR < 52.1, and Firefox < 53.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-54659.1An out-of-bounds read while processing SVG content in "ConvolvePixel". This results in a crash and also allows for otherwise inaccessible me CVE-2017-54666.1If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will ru CVE-2017-54677.5A potential memory corruption and crash when using Skia content when drawing content outside of the bounds of a clipping region. This vulner CVE-2017-54689.1An issue with incorrect ownership model of "privateBrowsing" information exposed through developer tools. This can result in a non-exploitab CVE-2017-54699.8Fixed potential buffer overflows in generated Firefox code due to CVE-2016-6354 issue in Flex. This vulnerability affects Thunderbird < 52.1 CVE-2017-54709.8Memory safety bugs were reported in Firefox 53 and Firefox ESR 52.1. Some of these bugs showed evidence of memory corruption and we presume CVE-2017-54719.8Memory safety bugs were reported in Firefox 53. Some of these bugs showed evidence of memory corruption and we presume that with enough effo CVE-2017-54729.8A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS layout when attempting to use a node i CVE-2017-54738.8Cross-site request forgery (CSRF) vulnerability in ntopng through 2.4 allows remote attackers to hijack the authentication of arbitrary user CVE-2017-54746.1Open redirect vulnerability in comment.php in Serendipity through 2.0.5 allows remote attackers to redirect users to arbitrary web sites and CVE-2017-54758.8comment.php in Serendipity through 2.0.5 allows CSRF in deleting any comments.CVE-2017-54768.8Serendipity through 2.0.5 allows CSRF for the installation of an event plugin or a sidebar plugin.