PT-2017-16508 · Mozilla+5 · Firefox Esr+6

Published 2017-03-17 · Updated 2024-12-12 · CVE-2017-5428

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Firefox ESR versions prior to 52.0.1 Firefox versions prior to 52.0.1

Description An integer overflow was reported in the createImageBitmap() function. The issue affects the content sandbox and requires a second vulnerability to compromise a user's computer. The estimated number of potentially affected devices is not specified.

Recommendations For Firefox ESR versions prior to 52.0.1, the fix disables the experimental extensions to the createImageBitmap API. For Firefox versions prior to 52.0.1, the fix disables the experimental extensions to the createImageBitmap API. As a temporary workaround, consider disabling the experimental extensions to the createImageBitmap API until a patch is available.

Exploit

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2017-1577

ALT-PU-2017-1578

CESA-2017_0558

CVE-2017-5428

OPENSUSE-SU-2017_0765-1

OPENSUSE-SU-2024:10600-1

OPENSUSE-SU-2024:14572-1

RHSA-2017:0558

RHSA-2017_0558

USN-3238-1

ZDI-17-234

Affected Products

Alt Linux

Centos

Firefox

Firefox Esr

Red Hat

Suse

Ubuntu

References · 1877

• 🔥 https://bugzilla.mozilla.org/show_bug.cgi?id=1348168 · Exploit
• https://ubuntu.com/security/CVE-2017-5428 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14572-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-5428 · Security Note
• https://mozilla.org/en-US/security/advisories/mfsa2017-08/#CVE-2017-5428 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3238-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3238-1 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-17-234 · Security Note
• https://mozilla.org/security/advisories/mfsa2017-08 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-5428 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2017-0558.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5428 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-5428 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10600-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2023-25728 · Note