CVE-2017-7845

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A buffer overflow occurs when drawing and validating elements using Direct 3D 9 with the ANGLE graphics library, used for WebGL content. This is due to an incorrect value being passed within the library during checks and results in a potentially exploitable crash. Note: This attack only affects Windows operating systems. Other operating systems are unaffected. This vulnerability affects Thunderbird < 52.5.2, Firefox ESR < 52.5.2, and Firefox < 57.0.2.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
Mozilla	Thunderbird	>= unspecified, < 52.5.2
Mozilla	Firefox ESR	>= unspecified, < 52.5.2
Mozilla	Firefox	>= unspecified, < 57.0.2

References

http://www.securityfocus.com/bid/102115Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040123Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1402372Issue Tracking, Permissions Required
https://www.mozilla.org/security/advisories/mfsa2017-28/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-29/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-30/Vendor Advisory
http://www.securityfocus.com/bid/102115Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040123Third Party Advisory, VDB Entry
https://bugzilla.mozilla.org/show_bug.cgi?id=1402372Issue Tracking, Permissions Required
https://www.mozilla.org/security/advisories/mfsa2017-28/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-29/Vendor Advisory
https://www.mozilla.org/security/advisories/mfsa2017-30/Vendor Advisory

Timeline

Published: Jun 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-78468.8It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g. via "View -> Feed article -> Website"CVE-2017-78474.3Crafted CSS in an RSS feed can leak and reveal local path strings, which may contain user name. This vulnerability affects Thunderbird < 52.CVE-2017-78485.3RSS fields can inject new lines into the created email structure, modifying the message body. This vulnerability affects Thunderbird < 52.5.CVE-2017-78495.5Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local denial of service condition due to insecure permissions when running in Ag CVE-2017-78507.8Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local privilege escalation issue due to insecure permissions when running in Age CVE-2017-78518.8D-Link DCS-936L devices with firmware before 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to b CVE-2017-78528.8D-Link DCS cameras have a weak/insecure CrossDomain.XML file that allows sites hosting malicious Flash objects to access and/or change the d CVE-2017-78537.5In libosip2 in GNU oSIP 4.1.0 and 5.0.0, a malformed SIP message can lead to a heap buffer overflow in the msg_osip_body_parse() function de CVE-2017-78545.5The consume_init_expr function in wasm.c in radare2 1.3.0 allows remote attackers to cause a denial of service (heap-based buffer over-read CVE-2017-78556.1In the webmail component in IceWarp Server 11.3.1.5, there was an XSS vulnerability discovered in the "language" parameter.CVE-2017-78569.8LibreOffice before 2017-03-11 has an out-of-bounds write caused by a heap-based buffer overflow in the SVMConverter::ImplConvertFromSVM1 fun CVE-2017-78579.8FreeType 2 before 2017-03-08 has an out-of-bounds write caused by a heap-based buffer overflow related to the TT_Get_MM_Var function in true