CVE-2017-5428

An integer overflow in "createImageBitmap()" was reported through the Pwn2Own contest. The fix for this vulnerability disables the experimental extensions to the "createImageBitmap" API. This function runs in the content sandbox, requiring a second vulnerability to compromise a user's computer. This vulnerability affects Firefox ESR < 52.0.1 and Firefox < 52.0.1.

CVSS v3.0

9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

3.25% chance of exploitation in the next 30 days, 87th percentile

Published

2018-06-11

Updated

2024-08-05

Proof-of-concept exploits (1)

• https://bugzilla.mozilla.org/show_bug.cgi?id=1348168

References

• CVE Record
• NVD entry

Related

• CVE-2017-5421
• CVE-2017-5433
• CVE-2017-5420
• CVE-2017-5438
• CVE-2017-5415
• CVE-2017-5439