CVE-2017-5428 is an integer overflow vulnerability in the createImageBitmap() function, affecting Firefox ESR < 52.0.1 and Firefox < 52.0.1. This critical vulnerability (CVSS 9.8) allows for remote code execution with low attack complexity, potentially leading to complete compromise of confidentiality, integrity, and availability. While the function runs in a content sandbox, requiring a second vulnerability for full system compromise, its high FAUCET Risk Score of 92/100 indicates significant danger. There is no public exploit code available (Metasploit, Nuclei, ExploitDB), and it is not listed on the KEV catalog, suggesting it is not actively exploited. However, the vulnerability garnered substantial community discussion and media coverage, particularly following its disclosure at Pwn2Own.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
7.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* | ||
7.3CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:* | ||
7.4CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.