CVE-2017-5428

An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the "createImageBitmap" API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer. This vulnerability affects Firefox ESR < 52.0.1 and Firefox < 52.0.1.

Affected

Mozilla · Firefox ESR · Firefox

CVSS v3.0 NVD

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

3.18% chance of exploitation in the next 30 days, 88th percentile

Published

2018-06-11

Updated

2024-08-05

Proof-of-concept exploits (1)

• https://bugzilla.mozilla.org/show_bug.cgi?id=1348168

Security advisories

• https://www.mozilla.org/security/advisories/mfsa2017-08
• http://rhn.redhat.com/errata/RHSA-2017-0558.html
• http://www.securityfocus.com/bid/96959
• http://www.securitytracker.com/id/1038060

References

• CVE Record
• NVD entry