Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Firefox and Thunderbird may crash on WebGL graphics

CVE-2017-5411 · published 8 years ago
Summary

The Windows graphics component used by older Firefox and Thunderbird versions can free memory while it is still needed, causing the applications to crash when showing WebGL content. This affects Firefox and Thunderbird versions earlier than 52 on Windows. Upgrade to the latest version of each program to eliminate the risk.

What to do
  • Update mozilla firefox to version 52.0 or later.
  • Update mozilla thunderbird to version 52.0 or later.
Affected software
VendorProductAffected versions
mozilla firefox < 52.0
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
mozilla thunderbird < 52.0
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
Original advisory text
A use-after-free can occur during buffer storage operations within the ANGLE graphics library, used for WebGL content. The buffer storage can be freed while still in use in some circumstances, lead...
A use-after-free can occur during buffer storage operations within the ANGLE graphics library, used for WebGL content. The buffer storage can be freed while still in use in some circumstances, leading to a potentially exploitable crash. Note: This issue is in "libGLES", which is only in use on Windows. Other operating systems are not affected. This vulnerability affects Firefox < 52 and Thunderbird < 52.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
2% chance of attack within 30 days
Type
CWE-416Use After Free
Timeline
Published11 Jun 2018
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-5411 · NVD
Track software like this
Free during beta