CVE-2017-5404: A use-after-free error can occur when manipulating ranges in selections with one node inside a native anonymous tree and one node outside of…

Versions reported by the vendor

Affected version ranges reported by the assigning authority (mozilla). Independent of NVD's CPE analysis and usually ahead of it.

• Mozilla Firefox

  • unspecified and later · before 52affected

• Mozilla Firefox ESR

  • unspecified and later · before 45.8affected

• Mozilla Thunderbird

  • unspecified and later · before 52affected
  • unspecified and later · before 45.8affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2016-9079A use-after-free vulnerability in SVG Animation has been discovered.KEV
  86Now
• CVE-2024-44308The issue was addressed with improved checks.KEV
  68This week
• CVE-2021-25216A second vulnerability in BIND's GSSAPI security policy negotiation can be targeted by a buffer overflow attack
  64This week

Published before and after this one in the same product

• ← EarlierCVE-2017-5401Jun 11, 2018 · A crash triggerable by web content in which an "ErrorResult" references unassigned memory due to a logic error.
  40Plan
• ← EarlierCVE-2017-5402Jun 11, 2018 · A use-after-free can occur when events are fired for a "FontFace" object after the object has been already been destroyed while working…
  40Plan
• Later →CVE-2017-5405Jun 11, 2018 · Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations.
  22Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.