2017 CVEs (page 19)
Page 19 of 148 — CVEs published in 2017, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2017-5463 | Medium | 5.3 | 2018-06-11 | Android intents can be used to launch Firefox for Android in reader mode with a user specified URL. This allows an attacker to spoof the contents of the addres… |
CVE-2017-5462 | Medium | 5.3 | 2018-06-11 | A flaw in DRBG number generation within the Network Security Services (NSS) library where the internal state V does not correctly carry bits over. The NSS libr… |
CVE-2017-5460 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability in frame selection triggered by a combination of malicious script content and key presses by a user. This results in a potential… |
CVE-2017-5459 | Critical | 9.8 | 2018-06-11 | A buffer overflow in WebGL triggerable by web content, resulting in a potentially exploitable crash. This vulnerability affects Thunderbird < 52.1, Firefox ESR… |
CVE-2017-5458 | Medium | 6.1 | 2018-06-11 | When a "javascript:" URL is drag and dropped by a user into the addressbar, the URL will be processed and executed. This allows for users to be socially engine… |
CVE-2017-5456 | Critical | 9.8 | 2018-06-11 | A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for read and… |
CVE-2017-5455 | High | 7.5 | 2018-06-11 | The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege if combined with another vulnerability… |
CVE-2017-5454 | High | 7.5 | 2018-06-11 | A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker thr… |
CVE-2017-5453 | Medium | 4.3 | 2018-06-11 | A mechanism to inject static HTML into the RSS reader preview page due to a failure to escape characters sent as URL parameters for a feed's "TITLE" element. T… |
CVE-2017-5452 | Medium | 4.3 | 2018-06-11 | Malicious sites can display a spoofed addressbar on a page when the existing location bar on the new page is scrolled out of view if an HTML editable page elem… |
CVE-2017-5451 | Medium | 4.3 | 2018-06-11 | A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event. The event could be used by script to affect text dis… |
CVE-2017-5450 | High | 7.5 | 2018-06-11 | A mechanism to spoof the Firefox for Android addressbar using a "javascript:" URI. On Firefox for Android, the base domain is parsed incorrectly, making the re… |
CVE-2017-5449 | High | 7.5 | 2018-06-11 | A possibly exploitable crash triggered during layout and manipulation of bidirectional unicode text in concert with CSS animations. This vulnerability affects… |
CVE-2017-5448 | High | 8.6 | 2018-06-11 | An out-of-bounds write in "ClearKeyDecryptor" while decrypting some Clearkey-encrypted media content. The "ClearKeyDecryptor" code runs within the Gecko Media… |
CVE-2017-5447 | Critical | 9.1 | 2018-06-11 | An out-of-bounds read during the processing of glyph widths during text layout. This results in a potentially exploitable crash and could allow an attacker to… |
CVE-2017-5446 | Critical | 9.8 | 2018-06-11 | An out-of-bounds read when an HTTP/2 connection to a servers sends "DATA" frames with incorrect data content. This leads to a potentially exploitable crash. Th… |
CVE-2017-5445 | High | 7.5 | 2018-06-11 | A vulnerability while parsing "application/http-index-format" format content where uninitialized values are used to create an array. This could allow the readi… |
CVE-2017-5444 | High | 7.5 | 2018-06-11 | A buffer overflow vulnerability while parsing "application/http-index-format" format content when the header contains improperly formatted data. This allows fo… |
CVE-2017-5443 | Critical | 9.8 | 2018-06-11 | An out-of-bounds write vulnerability while decoding improperly formed BinHex format archives. This vulnerability affects Thunderbird < 52.1, Firefox ESR < 45.9… |
CVE-2017-5442 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability during changes in style when manipulating DOM elements. This results in a potentially exploitable crash. This vulnerability affe… |
CVE-2017-5441 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability when holding a selection during scroll events. This results in a potentially exploitable crash. This vulnerability affects Thund… |
CVE-2017-5440 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability during XSLT processing due to a failure to propagate error conditions during matching while evaluating context, leading to objec… |
CVE-2017-5439 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability during XSLT processing due to poor handling of template parameters. This results in a potentially exploitable crash. This vulner… |
CVE-2017-5438 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability during XSLT processing due to the result handler being held by a freed handler during handling. This results in a potentially ex… |
CVE-2017-5436 | High | 8.8 | 2018-06-11 | An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font. This results in a potentially exploitable crash. This issu… |
CVE-2017-5435 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability occurs during transaction processing in the editor during design mode interactions. This results in a potentially exploitable cr… |
CVE-2017-5434 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability occurs when redirecting focus handling which results in a potentially exploitable crash. This vulnerability affects Thunderbird… |
CVE-2017-5433 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability in SMIL animation functions occurs when pointers to animation elements in an array are dropped from the animation controller whi… |
CVE-2017-5432 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability occurs during certain text input selection resulting in a potentially exploitable crash. This vulnerability affects Thunderbird… |
CVE-2017-5430 | Critical | 9.8 | 2018-06-11 | Memory safety bugs were reported in Firefox 52, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption and we presume that… |
CVE-2017-5429 | Critical | 9.8 | 2018-06-11 | Memory safety bugs were reported in Firefox 52, Firefox ESR 45.8, Firefox ESR 52, and Thunderbird 52. Some of these bugs showed evidence of memory corruption a… |
CVE-2017-5428 | Critical | 9.8 | 2018-06-11 | An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to t… |
CVE-2017-5427 | Medium | 5.5 | 2018-06-11 | A non-existent chrome.manifest file will attempt to be loaded during startup from the primary installation directory. If a malicious user with local access put… |
CVE-2017-5426 | Medium | 5.3 | 2018-06-11 | On Linux, if the secure computing mode BPF (seccomp-bpf) filter is running when the Gecko Media Plugin sandbox is started, the sandbox fails to be applied and… |
CVE-2017-5425 | High | 7.5 | 2018-06-11 | The Gecko Media Plugin sandbox allows access to local files that match specific regular expressions. On OS OX, this matching allows access to some data in subd… |
CVE-2017-5422 | High | 7.5 | 2018-06-11 | If a malicious site uses the "view-source:" protocol in a series within a single hyperlink, it can trigger a non-exploitable browser crash when the hyperlink i… |
CVE-2017-5421 | High | 7.5 | 2018-06-11 | A malicious site could spoof the contents of the print preview window if popup windows are enabled, resulting in user confusion of what site is currently loade… |
CVE-2017-5420 | Medium | 6.5 | 2018-06-11 | A "javascript:" url loaded by a malicious page can obfuscate its location by blanking the URL displayed in the addressbar, allowing for an attacker to spoof an… |
CVE-2017-5419 | High | 7.5 | 2018-06-11 | If a malicious site repeatedly triggers a modal authentication prompt, eventually the browser UI will become non-responsive, requiring shutdown through the ope… |
CVE-2017-5418 | Medium | 5.3 | 2018-06-11 | An out of bounds read error occurs when parsing some HTTP digest authorization responses, resulting in information leakage through the reading of random memory… |
CVE-2017-5417 | Medium | 5.3 | 2018-06-11 | When dragging content from the primary browser pane to the addressbar on a malicious site, it is possible to change the addressbar so that the displayed locati… |
CVE-2017-5416 | High | 7.5 | 2018-06-11 | In certain circumstances a networking event listener can be prematurely released. This appears to result in a null dereference in practice. This vulnerability… |
CVE-2017-5415 | Medium | 5.3 | 2018-06-11 | An attack can use a blob URL and script to spoof an arbitrary addressbar URL prefaced by "blob:" as the protocol, leading to user confusion and further spoofin… |
CVE-2017-5414 | Medium | 5.5 | 2018-06-11 | The file picker dialog can choose and display the wrong local default directory when instantiated. On some operating systems, this can lead to information disc… |
CVE-2017-5413 | Critical | 9.8 | 2018-06-11 | A segmentation fault can occur during some bidirectional layout operations. This vulnerability affects Firefox < 52 and Thunderbird < 52. |
CVE-2017-5412 | High | 7.5 | 2018-06-11 | A buffer overflow read during SVG filter color value operations, resulting in data exposure. This vulnerability affects Firefox < 52 and Thunderbird < 52. |
CVE-2017-5411 | High | 7.5 | 2018-06-11 | A use-after-free can occur during buffer storage operations within the ANGLE graphics library, used for WebGL content. The buffer storage can be freed while st… |
CVE-2017-5410 | Critical | 9.8 | 2018-06-11 | Memory corruption resulting in a potentially exploitable crash during garbage collection of JavaScript due errors in how incremental sweeping is managed for me… |
CVE-2017-5409 | Medium | 5.5 | 2018-06-11 | The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter throug… |
CVE-2017-5408 | Medium | 5.3 | 2018-06-11 | Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential informa… |
CVE-2017-5407 | Medium | 6.5 | 2018-06-11 | Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user. This c… |
CVE-2017-5406 | High | 7.5 | 2018-06-11 | A segmentation fault can occur in the Skia graphics library during some canvas operations due to issues with mask/clip intersection and empty masks. This vulne… |
CVE-2017-5405 | Medium | 5.3 | 2018-06-11 | Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations. This vulnerability affects Firefox < 52, F… |
CVE-2017-5404 | Critical | 9.8 | 2018-06-11 | A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of it. This results i… |
CVE-2017-5403 | Critical | 9.8 | 2018-06-11 | When adding a range to an object in the DOM, it is possible to use "addRange" to add the range to an incorrect root object. This triggers a use-after-free, res… |
CVE-2017-5402 | Critical | 9.8 | 2018-06-11 | A use-after-free can occur when events are fired for a "FontFace" object after the object has been already been destroyed while working with fonts. This result… |
CVE-2017-5401 | Critical | 9.8 | 2018-06-11 | A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error. The resulting crash may be exploitable. This vu… |
CVE-2017-5400 | Critical | 9.8 | 2018-06-11 | JIT-spray targeting asm.js combined with a heap spray allows for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vuln… |
CVE-2017-5399 | Critical | 9.8 | 2018-06-11 | Memory safety bugs were reported in Firefox 51. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of the… |
CVE-2017-5398 | Critical | 9.8 | 2018-06-11 | Memory safety bugs were reported in Thunderbird 45.7. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some… |
CVE-2017-5397 | Critical | 9.8 | 2018-06-11 | The cache directory on the local file system is set to be world writable. Firefox defaults to extracting libraries from this cache. This allows for the possibi… |
CVE-2017-5396 | Critical | 9.8 | 2018-06-11 | A use-after-free vulnerability in the Media Decoder when working with media files when some events are fired after the media elements are freed from memory. Th… |
CVE-2017-5395 | Medium | 4.3 | 2018-06-11 | Malicious sites can display a spoofed location bar on a subsequently loaded page when the existing location bar on the new page is scrolled out of view if navi… |
CVE-2017-5394 | High | 8.8 | 2018-06-11 | A location bar spoofing attack where the location bar of loaded page will be shown over the content of another tab due to a series of JavaScript events combine… |
CVE-2017-5393 | Medium | 6.1 | 2018-06-11 | The "mozAddonManager" allows for the installation of extensions from the CDN for addons.mozilla.org, a publicly accessible site. This could allow malicious ext… |
CVE-2017-5392 | Critical | 9.8 | 2018-06-11 | Weak proxy objects have weak references on multiple threads when they should only have them on one, resulting in incorrect memory usage and corruption, which l… |
CVE-2017-5391 | Critical | 9.8 | 2018-06-11 | Special "about:" pages used by web content, such as RSS feeds, can load privileged "about:" pages in an iframe. If a content-injection bug were found in one of… |
CVE-2017-5390 | Critical | 9.8 | 2018-06-11 | The JSON viewer in the Developer Tools uses insecure methods to create a communication channel for copying and viewing JSON or HTTP headers data, allowing for… |
CVE-2017-5389 | Medium | 6.1 | 2018-06-11 | WebExtensions could use the "mozAddonManager" API by modifying the CSP headers on sites with the appropriate permissions and then using host requests to redire… |
CVE-2017-5388 | High | 7.5 | 2018-06-11 | A STUN server in conjunction with a large number of "webkitRTCPeerConnection" objects can be used to send large STUN packets in a short period of time due to a… |
CVE-2017-5387 | Low | 3.3 | 2018-06-11 | The existence of a specifically requested local file can be found due to the double firing of the "onerror" when the "source" attribute on a "<track>" tag refe… |
CVE-2017-5386 | High | 7.3 | 2018-06-11 | WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or p… |
CVE-2017-5385 | High | 7.5 | 2018-06-11 | Data sent with in multipart channels, such as the multipart/x-mixed-replace MIME type, will ignore the referrer-policy response header, leading to potential in… |
CVE-2017-5384 | Medium | 5.9 | 2018-06-11 | Proxy Auto-Config (PAC) files can specify a JavaScript function called for all URL requests with the full URL path which exposes more information than would be… |
CVE-2017-5383 | Medium | 5.3 | 2018-06-11 | URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks i… |
CVE-2017-5382 | High | 7.5 | 2018-06-11 | Feed preview for RSS feeds can be used to capture errors and exceptions generated by privileged content, allowing for the exposure of internal information not… |
CVE-2017-5381 | High | 7.5 | 2018-06-11 | The "export" function in the Certificate Viewer can force local filesystem navigation when the "common name" in a certificate contains slashes, allowing certif… |
CVE-2017-5380 | Critical | 9.8 | 2018-06-11 | A potential use-after-free found through fuzzing during DOM manipulation of SVG content. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and… |
CVE-2017-5379 | High | 7.5 | 2018-06-11 | Use-after-free vulnerability in Web Animations when interacting with cycle collection found through fuzzing. This vulnerability affects Firefox < 51. |
CVE-2017-5378 | High | 7.5 | 2018-06-11 | Hashed codes of JavaScript objects are shared between pages. This allows for pointer leaks because an object's address can be discovered through hash codes, an… |
CVE-2017-5377 | Critical | 9.8 | 2018-06-11 | A memory corruption vulnerability in Skia that can occur when using transforms to make gradients, resulting in a potentially exploitable crash. This vulnerabil… |
CVE-2017-5376 | Critical | 9.8 | 2018-06-11 | Use-after-free while manipulating XSL in XSLT documents. This vulnerability affects Thunderbird < 45.7, Firefox ESR < 45.7, and Firefox < 51. |
CVE-2017-5375 | Critical | 9.8 | 2018-06-11 | JIT code allocation can allow for a bypass of ASLR and DEP protections leading to potential memory corruption attacks. This vulnerability affects Thunderbird <… |
CVE-2017-5374 | Critical | 9.8 | 2018-06-11 | Memory safety bugs were reported in Firefox 50.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of t… |
CVE-2017-5373 | Critical | 9.8 | 2018-06-11 | Memory safety bugs were reported in Firefox 50.1 and Firefox ESR 45.6. Some of these bugs showed evidence of memory corruption and we presume that with enough… |
CVE-2017-3208 | Critical | 9.8 | 2018-06-11 | The Java implementation of AMF3 deserializers used by WebORB for Java by Midnight Coders, version 5.1.1.0, allows external entity references (XXEs) from XML do… |
CVE-2017-3207 | Critical | 9.8 | 2018-06-11 | The Java implementations of AMF3 deserializers in WebORB for Java by Midnight Coders, version 5.1.1.0, derive class instances from java.io.Externalizable rathe… |
CVE-2017-3206 | Critical | 9.8 | 2018-06-11 | The Java implementation of AMF3 deserializers used by Flamingo amf-serializer by Exadel, version 2.2.0, allows external entity references (XXEs) from XML docum… |
CVE-2017-3203 | High | 8.1 | 2018-06-11 | The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specificat… |
CVE-2017-3202 | Critical | 9.8 | 2018-06-11 | The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes via their… |
CVE-2017-3201 | High | 8.1 | 2018-06-11 | The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0 derives class instances from java.io.Externalizable rath… |
CVE-2017-3200 | High | 8.1 | 2018-06-11 | The Java implementation of AMF3 deserializers used in GraniteDS, version 3.1.1.G, may allow instantiation of arbitrary classes via their public parameter-less… |
CVE-2017-3199 | High | 8.1 | 2018-06-11 | The Java implementation of GraniteDS, version 3.1.1.GA, AMF3 deserializers derives class instances from java.io.Externalizable rather than the AMF3 specificati… |
CVE-2017-1405 | Medium | 4.4 | 2018-06-08 | IBM Security Identity Manager Virtual Appliance 7.0 processes patches, image backups and other updates without sufficiently verifying the origin and integrity… |
CVE-2017-12078 | High | 7.2 | 2018-06-08 | Command injection vulnerability in EZ-Internet in Synology Router Manager (SRM) before 1.1.6-6931 allows remote authenticated users to execute arbitrary comman… |
CVE-2017-12075 | High | 7.2 | 2018-06-08 | Command injection vulnerability in EZ-Internet in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to execute arbitrary co… |
CVE-2017-6294 | High | 7.8 | 2018-06-07 | In Android before the 2018-06-05 security patch level, NVIDIA Tegra X1 TZ contains a possible out of bounds write due to missing bounds check which could lead… |
CVE-2017-6292 | High | 7.8 | 2018-06-07 | In Android before the 2018-06-05 security patch level, NVIDIA TLZ TrustZone contains a possible out of bounds write due to integer overflow which could lead to… |
CVE-2017-6290 | High | 7.8 | 2018-06-07 | In Android before the 2018-06-05 security patch level, NVIDIA TLK TrustZone contains a possible out of bounds write due to an integer overflow which could lead… |
CVE-2017-6779 | High | 7.5 | 2018-06-07 | Multiple Cisco products are affected by a vulnerability in local file management for certain system log files of Cisco collaboration products that could allow… |